Our substance is short yet to the point, and intended to challenge you to live in and nurture with IT technologies. @http://thecorlissreviewgroup.com

Monday, June 23, 2014

The Corliss Group Latest Tech Review: When Technology Helps Consumers Challenge the Status Quo

Adapting to change is hard, especially when your family’s livelihood is on the line. That’s why, when companies face competition, their tendency is to reach out to the government to ask for protection and demand that competition be squashed using the regulatory and coercive power of the state.

The best example is the fight between taxicabs and companies such as Uber and Lyft, two innovative up-and-coming alternatives to cabs. It’s been going on for months, but it culminated a few weeks ago in Virginia when the Virginia Department of Motor Vehicles sent cease-and-desist letters to Uber Technologies and Lyft ordering them to stop operating.

Over at the Washington Post last week, Emily Bagger had a piece explaining what is really at stake for cab companies: cab medallions. As the piece explains “a medallion in Chicago fetched around $350,000. . . . In New York, taxi medallions have topped $1 million. In Boston, $700,000. In Philadelphia, $400,000. In Miami, $300,000.”

One way to think about medallions is that they are the reward for companies subjecting themselves to the insane and punishing licensing laws imposed by the government.

CHICAGO — A taxicab is a car remade by government, modified dozens of ways by edicts within subsections of articles of the city’s taxi code.

“Everywhere on this car has been regulated,” John Henry Assabill says. “Look at it!”

He throws up his arms in the direction of his gold-colored 2012 Ford Transit Connect. The car’s medallion number — 813 — is painted in black plain gothic figures (must be black plain gothic figures) on the driver’s-side hood, on both passenger doors and, for good measure, on the rear. Inside, there is a camera mounted over the rear-view mirror, a dispatch radio bolted to the console, a credit-card reader snapped to the passenger headrest.

From the back of Assabill’s seat hangs a sign — lamination required — spelling out the city’s fare structure: $3.25 for the base rate, $2 for the airport departure/arrival tax, $50 vomit cleanup fee. Everywhere, there are mandatory stickers. “That one costs a dollar,” Assabill says of a window decal reminding passengers to LOOK! before opening the door into the possible path of cyclists and pedestrians. “The fine for not having it is $100.”

Then there are the holes. Several have been drilled into the roof to mount the top light that distinguishes cabs from other cars at a distance. Another has been punched right into the hood, bolting down the palm-size metal plate — the “medallion” itself — that gives Assabill the right to operate this cab, one of 6,904 in Chicago.

The losers of this ban are low-income Americans looking to make a living. These ride-sharing companies allow anyone who has a car to become a businessman: Drivers can provide travel services directly to customers using apps.

And this is where Uber and similar companies come in: They are alternatives to traditional anti-competitive, highly regulated taxis. Taxi medallions, fare price-fixing, and other regulatory barriers to entry have all but drained the last competitive juices from the legacy taxi system. Without these limitations, Uber and Lyft are able to offer their customers better services at more reasonable prices. In addition, being new companies in a competitive market, they understand that they had better make sure their customers are satisfied so they will come back often. And this is a key point that seems lost in the current debate: Consumers are the ones at the core of the existence of Uber and Lyft.

Unfortunately for consumers and low-income workers who were making a living from these new ventures, lawmakers are only too happy to get captured by incumbents in the cab industry. As I wrote in the Examiner on Friday:

Of course, politicians and regulators are the ones to blame. It is because lawmakers allow themselves to be captured by special interests who want to fence off competition that innovators and new comers have to ask for permission to give customers what they want. Without over-the-top economic regulation over rates, entry, and new technologies, incumbent cab drivers would have to compete for customers over the quality of the services they provide. And in fact, it is the decades of protection from competition that has left taxi companies complacent and largely unequipped to nimbly improve their businesses.

There is a reason consumers like companies such as Uber and Lyft. They provide them with the service they want at a price that suits them. I understand that after having been forced to comply with onerous licensing laws and fees, cabbies are invested in the current system. But I think that a better course of action going forward is to minimize barriers to entry and regulations; that is the way innovation occurs and consumers are better served. There is no stopping this new era of consumer-driven transportation companies. The State of Virginia may crush Uber this time around, but other companies will appear now that consumers have gotten a taste for freedom.

As a matter of principle, conservatives should be against licensing laws. They hinder employment, especially for lower-income workers, and create artificial barriers to entry in order to protect incumbents against often very needed competition. AEI’s Michael Strain made that case in a book chapter called “Employment: Policies To Get Americans Working Again,” and then in piece in the Washington Post last week. As he explains, conservatives should strive to address long-term unemployment, which means making it easier to find work. Getting rid of occupational-licensing laws would really help, he argues.

Here is my Reason piece on the issue.

Sunday, June 15, 2014

Facebook acquisition of Oculus could end up boosting crowd funding



The Corliss Group Latest Tech Review – The concept of crowd funding new technology companies took a hit earlier this year when Oculus was bought by Facebook FB  for about $2 billion.

Participants in a $2.4 million Kickstarter campaign that helped fund Oculus and its development of a virtual reality headset, wound up with nothing to show for their support, while the founders and early investors scored astronomical gains.

In the wake of the bitterness over the deal, there are movements to change laws that limit the sale of equity stakes to small investors.

Slava Rubin, CEO and founder of crowd-funding platform Indiegogo, says that eventually those laws, including the so-called JOBS Act, will evolve in a positive way.

“It’s about access to capital. It will democratize investing,” he told MarketWatch at the Nantucket Conference in Massachusetts, a gathering for tech entrepreneurs and others recently.

Current laws, including the JOBS Act, prevent private companies from selling shares to unqualified investors, those with less than $1 million in assets and $200,000 income.

While changes in the laws would open access to capital for startups, regulators argue that unsophisticated investors in such companies could easily lose their shirts. After all, such equity tends to be highly illiquid, and many  startups fail.  In addition there are concerns over fraud. 

Rubin said that people should differentiate between fraud and failure. “Since its launch, Indiegogo has not had a single case of fraud. But failure is not a fraud, and that happens,” he said.

Anticipating such changes in laws that limit small investor equity stakes, Wayne Mulligan founded Crowdability.com, a company with the purpose of educating retail investors.

“We aim to be the place an investor visits before making an investment decision,” Mulligan wrote on the company’s blog post. “Morningstar has done a great job building a place like this for mutual-fund investors. Our goal is to build the most trusted place for equity crowdfund investors”


Friday, June 13, 2014

How Can Space Tech Help Detect Bank Fraud On Earth?


The Corliss Group Latest Tech Review – Drawing on their experience building complex software for simulating spaceflight, Portuguese scientists have created a 21st-century way of detecting banking fraud here on Earth.

Today, every electronic purchase in Portugal runs through their software. Around the globe, Feedzai products screen some US$229 billion-worth of payments every year.

But what do space missions and software designed to find thieves have in common? More than you might think – in addition to high-tech hardware, space missions require a great deal of sophisticated software.

“When you launch a spacecraft, you need software to guide it,” explained Feedzai’s Paulo Marques, who was an ESA consultant before founding Feedzai in 2009. “You also need software for communications from the ground.”

Long before a spacecraft is launched, the software must be thoroughly tested for flaws. There’s just one problem, explained Paulo: “You don’t have an actual spacecraft yet.”

So, scientists build a software universe to simulate the mission.

“What you need to have is something that represents the spacecraft, mission control and ground stations, along with many other components, in order to check it all.”

At ESA, Paulo and Feedzai’s Nuno Sebastiao called on high-performance computing techniques to create virtual satellites: “Clusters of computers pretend to be everything involved. A computer acts like a spacecraft.”

The software must be very robust in order to mimic each element of the mission and spacecraft perfectly.

And it must be able to do this quickly – in far less time than it would take to complete an actual mission.

“The software has to be able to process all the information it gets in a very, very effective way,” said Paulo, “as if it were the real spacecraft.”

Spacecraft operators also train using this software. “You are not going to put a spacecraft in the hands of someone who hasn’t trained before.”

Space experience for stopping fraud

Fraud detection and space mission software face similar challenges. For one thing, both need to process huge amounts of information in real time. “If we talk about a bank, you need to process thousands of transactions every single second.”

In bank fraud detection, as in space, software must recognize anything that is out of the ordinary.

In space, an unexpected change in temperature could indicate a crack in the wall. In banking, anomalies often point to fraud: if a petrol station suddenly starts generating sales figures like those of a luxury car dealership, it is a sign of trouble.

However, there are differences. While hard-and-fast rules are set to detect an anomaly in space, fraud requires decisions on a case-by-case basis. A sudden temperature change in a spacecraft is always a problem, but each bank customer has his own, individual habits.

As a result, the software must recognize what is normal for a business-owner and what is normal for a teacher, based on the past practices of each, before it can identify any odd behavior.

To make this possible, Feedzai came up with an artificial intelligence software system.

“We developed software that can process a huge number of transactions,” said Paulo. This software can look at every transaction a customer has made for the last four years.

By applying both ‘machine learning’ and ‘big-data techniques’ to look at all the data, the software learns to distinguish fraudulent-looking from non-fraudulent-looking transactions.

“The software creates the rules.”

Feedzai’s software is certainly robust. Tracking over 300 variables per person, it creates very detailed, individualized spending profiles for as many as 20 million credit cardholders per system. “In total we are tracking over five billion variables continuously.”

“It’s like having 500 very intelligent people looking at every single transaction and making a call based on their experience if it’s fraud or not. It’s a huge amount of computing power.”

Carlos Cerqueira from Instituto Pedro Nunes, the Portuguese broker in ESA’s Technology Transfer Network part of ESA’s Technology Transfer Programme, believes Feedzai’s technology will mean savings for banks, as well as improved customer loyalty: “Feedzai’s machine learning models and big data science are able to detect fraud up to 30% earlier than traditional methods, and illustrate how the competencies developed at ESA research centres can be useful to other sectors.”

Space knowledge generates growth

This year, Feedzai moved its headquarters from Portugal to California as they expand further into the world market.

”It is great to see that the expertise and knowledge generated on European space programs also can lead to innovative techniques in fighting credit card fraud,” said Frank M. Salzgeber, Head of ESA’s Technology Transfer Programme Office.

“It illustrates very well the spin-off potential from our space programmes. Dealing with space calls for leading-edge technological solutions, which explains why the space industry is often far ahead of others.”

Portugal’s delegate to ESA, Luís Serina, emphasised that, “This success case shows us that the investment in ESA also contributes to the creation of jobs and growth through technological innovation, which is even more important nowadays.”

Certainly, there is plenty of fraud to go around: each year, $11.4 billion is lost to credit card fraud. As cybercriminals grow more sophisticated, that number is likely to grow.

“We’re part of the defence mechanism,” said Feedzai spokesperson Loc Nguyen. “The invisible layer you as a consumer never think about. If you don’t know about us, it means that we’re working.”


Thursday, June 12, 2014

The Corliss Group Latest Tech Review: Space simulation technologies inspire anti-fraud systems on Earth


Drawing on their experience building complex software for simulating spaceflight, Portuguese scientists have created a 21st-century way of detecting banking fraud here on Earth.

Today, every electronic purchase in Portugal runs through their software. Around the globe, Feedzai products screen some US$229 billion-worth of payments every year.

But what do space missions and software designed to find thieves have in common? More than you might think – in addition to high-tech hardware, space missions require a great deal of sophisticated software.

"When you launch a spacecraft, you need software to guide it," explained Feedzai's Paulo Marques, who was an ESA consultant before founding Feedzai in 2009. "You also need software for communications from the ground."

Long before a spacecraft is launched, the software must be thoroughly tested for flaws. There's just one problem, explained Paulo: "You don't have an actual spacecraft yet."

So, scientists build a software universe to simulate the mission.

"What you need to have is something that represents the spacecraft, mission control and ground stations, along with many other components, in order to check it all."

At ESA, Paulo and Feedzai's Nuno Sebastiao called on high-performance computing techniques to create virtual satellites: "Clusters of computers pretend to be everything involved. A computer acts like a spacecraft."

The software must be very robust in order to mimic each element of the mission and spacecraft perfectly.

And it must be able to do this quickly – in far less time than it would take to complete an actual mission.
"The software has to be able to process all the information it gets in a very, very effective way," said Paulo, "as if it were the real spacecraft."

Spacecraft operators also train using this software. "You are not going to put a spacecraft in the hands of someone who hasn't trained before."

Space experience for stopping fraud

Fraud detection and space mission software face similar challenges. For one thing, both need to process huge amounts of information in real time. "If we talk about a bank, you need to process thousands of transactions every single second."


In bank fraud detection, as in space, software must recognise anything that is out of the ordinary.
In space, an unexpected change in temperature could indicate a crack in the wall. In banking, anomalies often point to fraud: if a petrol station suddenly starts generating sales figures like those of a luxury car dealership, it is a sign of trouble.

However, there are differences. While hard-and-fast rules are set to detect an anomaly in space, fraud requires decisions on a case-by-case basis. A sudden temperature change in a spacecraft is always a problem, but each bank customer has his own, individual habits.

As a result, the software must recognise what is normal for a business-owner and what is normal for a teacher, based on the past practices of each, before it can identify any odd behaviour.

To make this possible, Feedzai came up with an artificial intelligence software system.
"We developed software that can process a huge number of transactions," said Paulo. This software can look at every transaction a customer has made for the last four years.

By applying both 'machine learning' and 'big-data techniques' to look at all the data, the software learns to distinguish fraudulent-looking from non-fraudulent-looking transactions.

"The software creates the rules."


Feedzai's software is certainly robust. Tracking over 300 variables per person, it creates very detailed, individualised spending profiles for as many as 20 million credit cardholders per system. "In total we are tracking over five billion variables continuously."

"It's like having 500 very intelligent people looking at every single transaction and making a call based on their experience if it's fraud or not. It's a huge amount of computing power."

Carlos Cerqueira from Instituto Pedro Nunes, the Portuguese broker in ESA's Technology Transfer Network part of ESA's Technology Transfer Programme, believes Feedzai's technology will mean savings for banks, as well as improved customer loyalty: "Feedzai's machine learning models and big data science are able to detect fraud up to 30% earlier than traditional methods, and illustrate how the competencies developed at ESA research centres can be useful to other sectors."

Space knowledge generates growth

This year, Feedzai moved its headquarters from Portugal to California as they expand further into the world market.

"It is great to see that the expertise and knowledge generated on European space programmes also can lead to innovative techniques in fighting credit card fraud," said Frank M. Salzgeber, Head of ESA's Technology Transfer Programme Office.

"It illustrates very well the spin-off potential from our space programmes. Dealing with space calls for leading-edge technological solutions, which explains why the space industry is often far ahead of others."

Portugal's delegate to ESA, Luís Serina, emphasised that, "This success case shows us that the investment in ESA also contributes to the creation of jobs and growth through technological innovation, which is even more important nowadays."

Certainly, there is plenty of fraud to go around: each year, $11.4 billion is lost to credit card fraud. As cybercriminals grow more sophisticated, that number is likely to grow.

"We're part of the defence mechanism," said Feedzai spokesperson Loc Nguyen. "The invisible layer you as a consumer never think about. If you don't know about us, it means that we're working."




Wednesday, June 11, 2014

Growing fraud detection firm latest tech firm to redesign in Big Pink

The Corliss Group Latest Tech Review – The leadership team at online fraud detection firm iovation had a choice to make: remodel their existing 18,500 square feet in U.S. Bancorp Tower or move into new, bigger space to accommodate its growing 88-person Portland team.

They decided to stay, work with their landlord and retool what was previously a very traditional office.
The new space should hold about 100 people, which is what the company’s Portland team is projected to be by the end of this year. The company currently has about 90 people worldwide. The company also expects business to grow 30 percent this year over last year.

iovation is the latest tech firm to reimagine what a workspace within a corporate tower can look like. The others were New Relic, SurveyMonkey and Webtrends.

For iovation, the company is reducing the size of workspace cubicles, from roughly eight feet by eight feet to six feet by six feet — though Vice President of Operations and co-founder Molly O’Hearn assures that they will still be roomy. The cubicle walls are also coming down in height allowing for more of an open feel and more sight lines.

Walls for offices and conference rooms around perimeter will also now incorporate glass so people will be able to see in and see the view from the 32-story perch.

“We’re taking advantage of the views and being efficient,” said CEO and co-founder Greg Pierson.
The company is also paying attention to the amenities in the kitchen — which employees said is an important aspect of the office — and doubling the number of conference rooms.

While the work is occurring the company has decamped to another floor in the building. The team expects to be back in the space by mid-August. The company has more than 2 billion unique Internet devices in its knowledge base and from a production standpoint the temporary move hasn’t been a problem.

Corliss Group Latest Tech Review on Facebook




Friday, June 6, 2014

The Corliss Group Latest Tech Review: ‘RIGHT TO BE FORGOTTEN’

While I find the Right to be forgotten’ law/precedent interesting and even convivial, the fact remains that such a law may have grave implications on our society. By society, I mean the global village we find ourselves in today and the throng of imperfect, inadequate and sometimes inhuman inhabitants (e.g. BH), we find within this space.

Undoubtedly, we all have things and phases of lives we would like forgotten, but for the greater good of society this might not always be appropriate and fair to all parties concerned – particularly when the action in question impacts on others directly.

The question is this, ‘does the right to keep an information private/hidden/and away from public eye supersede the right (Freedom) of the public to that information?’

The ‘Right to Forgotten’ Law recently came under fire and into proper scrutiny on May 13, 2014 when search engine (research) giant, Google (GOOG) lost a data privacy suit against it at the European Court in Luxembourg.

 The European Court of Justice in its ruling confirmed that an EU law exists which allows citizens to claim a “right to be forgotten” stating that Google is bound to obey this law and must enforce it.

The court’s ruling established that armed with a “right to be forgotten,” an individual can make a request to Google, asking it to remove information about them from its search guide. This request could be pictures displaying youthful exuberance, moments of indiscretion, offensive comments on a social media website, malicious allegations, old publications of financial impropriety, links to old debts, notifications of court orders, unfavourable court orders, company filings, etc.

This precedent laid down, which currently applies across the EU, now forces Google and other online publishers to handle all information received differently.

Holistically speaking, the law imposes on Google, the duty/obligation to manage content on its servers and links. Google is effectively responsible for content, even if it was simply processing it on its servers and presenting links. If it receives a legitimate request to delete information on those servers, it must do so, even if that information is still published legally on the internet.

After the ruling, Google Inc. (GOOG) has had consultations with data-protection regulators and just two days ago, Friday May 30th, 2014 the company came up with an online tool to remove personal information where the need arises. The new web form allows citizens in 28 European countries to request the Google search platform to remove results for queries that include their names where those results are ‘inadequate, irrelevant, no longer relevant, or excessive in relation to the purposes for which they were processed.’

Interestingly, the arguments for and against this law and the decision of the court, has been diverse and far-reaching beyond the EU.

In the United States of our America, where the scales are tilted in favour of Free Speech and Freedom of Information, as against the right to privacy, observers and critics actually consider the ruling a “Blow” against free speech.”

Nigeria on the other hand, currently has no significant Data/information or Privacy protection law (An Act). Whilst our Constitution (Constitution of the Federal Republic of Nigeria, 1999) provides for our Right to Privacy in Section 37, it is not far-reaching enough to cater for Data/information protection abuse. Nonetheless, certain precedents such as the case of Ariori v. Elemo (1983) 1 SC 13, which attempted to take care of this, by establishing public interest over and above private interests.

Data protection involves strategic measures to manage and safeguard the unauthorised access or use of data, and efforts at enacting an appropriate data protection law in Nigeria – one that is far reaching, has met with great hurdles after seven attempts.

The first attempt was in 2005 – a bill for an Act to provide for Computer Security and Critical Information Infrastructure Protection Bill was proposed; the next was the Cyber Security and Data Protection Agency Bill 2008; followed by the Electronic Fraud Prohibition Bill 2008; the Nigeria Computer Security and Protection Agency Bill 2009; Computer Misuse Bill 2009 and the Economic and Financial Crimes Commission Act (Amendment) Bill 2010, and again the Cyber Security and Information Protection Agency Bill 2012, which has gone through its 2nd reading.

Speaking on the issue, Anti-Counterfeit expert and Partner in charge of Brand Protection, Media and Entertainment Practice at commercial law firm Jackson Etti & Edu, Obafemi Agaba, notes that a privacy law or precedent such as the “Right to be Forgotten” ruling handed down against Google, should ordinarily take into consideration public safety and interest.

In his view, “whilst we have no set privacy laws in Nigeria, an individual can have recourse under the fundamental rights provision in the 1999 constitution  as well as in common law. I also believe that a Data Protection/Privacy law in any part of the world should take into consideration the good of the public and their right to know.”

He continues, “That part of an individual’s life which directly affects or impacts the public should be left open and accessible to the public. As a legal practitioner and a privacy expert, I always advice my clients about the position of the law where the individual’s interests conflicts with that of the law,” he concluded.

However, Mena Ajakpovi an expert in Commercial litigation, whose clients range from public officers to artists and star entertainers, believes that there must be an “established’ overriding statutory public interest” before such data can be considered ‘NOT PRIVATE’ and made accessible to the public.

Citing the case of Ariori v. Elemo, he explains, “In the face of that responsibility, if pulling down or removing that information or data by an individual pre-disposes him/her to commit that an offence or infringing on the right of another.”

The critical issue however, is striking that balance between allowing individuals control of their online presentation and ensuring that the system is not abused to remove stories in the public interest.

While Civil rights and Public Interest advocates continue to express concerns as to who has the role of deciding what is in the public’s interest, another Nigerian Legal Practitioner, Ayodele Oni does not think it is Google’s role or any other Search engine to make public an individual’s private information that he/she wants hidden or kept private from public eye.

Hear him, “It is trite (commonplace) that a person is not entitled to a reputation he or she does not have. That said, to the extent that there are other records publicly available, I believe that persons can request a firm like Google to delete their offensive records. Where anyone needs to conduct a criminal check, then they can visit bodies statutorily empowered or obliged to keep same (e.g. the Police or the EFCC) and not firms such as Google etc.

“We need to work on our data storage and keeping system in Nigeria like the credit bureau newly established in Nigeria. So for credits now, there is now typically a credit record check. We can adopt that for other issues such as criminal, bankruptcy and the likes,” he said

Situations where data protection might be overlooked are found in legislations such as the European Convention on Human rights, which allows access to a government agency or public authority in a democratic society – but must only do so where it is absolutely necessary and is in the interest of national security, public safety, the economic well-being of the country, the prevention of crime, or for the protection of the rights and freedoms of others.

In the weeks that have passed after the ruling, the questions persist. Questions that bother on, “What happens when a budding politician with a criminal conviction or unsavory public comments that are mentioned in an online post wants it removed? Would it be right for content censorship to clear the path to them becoming a public figure? What happens to the fiancée of a convicted fraudster who may be deprived of the right to see information relating to their past because he/she has asked for it to be removed from Google searches or any other search platform?

As they continue to lament the implication of the ruling, FOI proponents and promoters believe that it has set an unusual and unwelcome precedent, whilst describing it as radical.

Google has confirmed that since the ruling was announced a few weeks ago, they have received thousands of requests, including a scandal-hit politician, a paedophile convicted of possessing images of child abuse, and a doctor who wanted negative reviews of his practice removed.

One thing is certain though, ‘Reputation Managers’, ‘Publicists’ or whatever they are called these days, are having a field day now.

But the question remains…..TO KNOW OR NOT TO KNOW. What Prevails?


Thursday, June 5, 2014

The Corliss Group Latest Tech Review: Mobile malware and operating system vulnerabilities

9% of large organisations face security, hacking, phishing scams and internet fraud in mobile devices
Industry experts to share insights helping businesses defend from cyberattacks during security sessions and workshops at Gulf Information Security Expo & Conference

Dubai, United Arab Emirates: As the Middle East and Africa region continue to experience a rapid growth in the sales and penetration of smartphones, with a population of more than 525.8 million using mobile devices in 20131, an increasing number of malware attacks also pose a threat to millions of smartphone users. Tackling the importance of mobile security, the second Gulf Information Security Expo & Conference (GISEC) 2014, taking place from 9 to 11 June at Dubai World Trade Centre (DWTC), will discuss ways to secure the mobile environment against evolving threats.

The unfettered growth in mobility created an alluring opportunity for cybercriminals with 9% of large organisations experienced a security or data breach in smartphones or tablets, according to a 2013 PricewaterhouseCoopers (PwC) survey. The widespread use of mobile devices resulted to various cybercrimes such as hacking, phishing scams and internet fraud. Smartphones are usually attacked through malwares, Trojan horse viruses and malicious software such as Loozon and FinFisher.

Among the GISEC Conference speakers is Nader Henein, Advance Security Solutions, Advisory Division at Blackberry, who will talk about devising a fit-for-purpose bring-your-own-device (BYOD) security plan that capitalises on the innovation and productivity of a mobile workforce. Also included in his presentation are the introduction of more stringent authentication and access controls for critical business apps and balancing the legal and electronic recovery implications of mobile devices with governance and compliance.

Heinen will also tackle mobile malware tactics and recent advances in Android malware as well as dissecting the anatomy of a mobile attack. According to Sophos Mobile Security Threat Report 2014, the exponential growth in Android devices and the buoyant and largely unregulated Android app market produced a sharp rise in malware targeting that platform. SophosLabs has seen over 650,000 individual pieces of malware for Android, which has grown quickly in a short period of time due to the increasing use of mobile devices.

"Security for mobile devices, applications and content is a paramount concern in a mobility management strategy," said Ian Evans, Managing Director and Senior Vice President, AirWatch by VMware EMEA. "Allowing corporate-owned or employee-owned devices to access corporate data requires a strong enterprise security strategy to ensure the deployment is secure and corporate information is protected."

Brian Lord, Managing Director, PGI Cyber, commented: "PGI (Protection Group International) recognises that the growth of mobile device use is essential for commerce, governments and individuals. They increase efficiency, drive down costs and afford maximum flexibility. As with all information and communication media, they also come with their own security risks. PGI's solutions, whether advisory or technical, all encompass the security risk posed by mobile devices - whether that is an individual device or an integral part of an organisation's infrastructure - and afford protection without detracting from the huge value such devices bring." he added.
During the two-day conference, leading information security experts headlined by Robert Bigman, former Chief Information Security Officer at the CIA; Mikko Hypponen, Chief Research Officer at F-Secure and Wim Remes, Chairman of the Board of Directors at (ISC)2 will discuss various topics on cyber threats and cybersecurity.

Bigman's keynote address of Day 1 of the GISEC Conference will shed light on the vulnerability of Heartbleed, especially clear prevention methods the audience can use to protect their internal corporate networks under the theme 'Change the way you connect to the internet'. Hypponen - the man who tracked down the authors of the first PC virus ever recorded - will deliver his keynote address on Day 2 of the GISEC Conference and will discuss critical information security issues to empower one with superior protection. Remes will focus on strategies to map out existing infrastructures to adequately protect them against realistic threats among several others.

Meanwhile, GISEC will also hold free-to-attend security sessions on vendor-run educational presentations, workshops, demonstrations, informative speeches and case-studies giving I.T. professionals useful insights to help defend their businesses from cyberattacks. Based on the Official CISSP CBK® Review Seminar, (ISC)2 will offer an education programme focusing on two of the most challenging domains of the CISSP CBK: Information Security Governance and Risk Management; and Access Control delivered by an Authorised (ISC)2 Instructor. All attendees will receive CISSP certificate.

As the region's only large-scale information security platform, GISEC will gather industry, government and thought leaders as well as international and regional cybersecurity experts in various business verticals such as I.T., oil & gas, banking & finance, government, legal, healthcare and telecoms to meet the growing requirements for information security and countermeasures in the region.

The must-attend event is set to draw 3,000 trade visitors from 51 countries and more than 100 exhibitors from the world's leading information security companies and brands. 91% of last year's attendees were purchasing decision makers from a wide range of industries.

Among the key sponsors of the exhibition are BT Global as Strategic Sponsor; GBM as Diamond Sponsor; Spire Solutions and Protection Group International as Platinum Sponsors; Access Data, Websense International, Fire Eye and F5 Networks as Gold Sponsors; Research in Motion (Blackberry), CSC Computer Sciences, Guidance Software and Palo Alto Networks as Silver Sponsors. Meanwhile, Palladium is the sponsor for the IT Security Awards.


Powered by GITEX TECHNOLOGY WEEK, the region's leading Information and Communications Technology (ICT) event, GISEC is strictly a trade-only event and is open to business and trade visitors from within the industry only. GISEC is open 10am-6pm from 9-11 June. Visitor attendance is free of charge. For more information, please visit www.gisec.ae.

Wednesday, June 4, 2014

The Corliss Group Latest Tech Review: US cyberspying case against Chinese military officials is all talk, no action


Two weeks after the Obama administration announced a groundbreaking criminal case, accusing five Chinese military officers of hacking into US companies to steal trade secrets, the accused have yet to be placed on Interpol's public listing of international fugitives.

What's more, there is no evidence that China would entertain a formal US request to extradite them.


Short of the five men flying to the US for a vacation, for example, there's no practical way they could be arrested outside China without help from foreign governments. It's also unclear whether the charges levied by the US are accepted internationally as crimes. No country so far has publicly expressed support for the groundbreaking charges.

The Obama administration described the unusual indictment on May 19 as a wake-up call for China to stop stealing US trade secrets. The FBI published "wanted" posters with pictures of all five Chinese military officers. Attorney General Eric Holder said such hacking suspects "will be exposed for their criminal conduct and sought for apprehension and prosecution in an American court of law".

Now, weeks later, that's looking less likely than ever, illustrating the complex legal and diplomatic issues posed by the indictment. There may be no viable options for Holder to make good on his word.

"The next step needs to be [we], here in the US, saying this is not just a US-China issue," said Shawn Henry, former cyber director at the FBI and now president of CrowdStrike Services, a security technology company. "This is a China-versus-the-world issue."

So far, the US does not appear to have the world on its side.

Neither officials in China nor the US said they would comment on any efforts by American prosecutors to arrest the Chinese military officers. The White House and State Department directed inquiries to the Justice Department, where spokesman Marc Raimondi said: "Our investigation is active, and we are not going to comment on specific actions to locate the individuals charged in the indictment."

A federal grand jury charged the five Chinese military officials with hacking into five US nuclear and technology companies' computer systems and a major steel workers union's system, conducting economic espionage and stealing confidential business information, sensitive trade secrets and internal communications for competitive advantage.

The US and China have no extradition treaty. And China's laws preclude extraditing citizens to countries where there's no treaty.

China has denied the hacking allegations and wants the US to revoke the indictment. A defence ministry spokesman, Geng Yansheng, said last week that the case ran counter to China-US military cooperation and had damaged mutual trust. Citing the suspension of dialogue on computer security, Geng said further responses from China would depend on Washington's attitude and actions.

"The Chinese are obviously not going to extradite their officials to the US," said John Bellinger, former State Department legal adviser. For this reason, Bellinger said he did not expect the US to make the request. "To ask them to do something that they're obviously going to then deny makes [the US] look ineffectual," he said.

The US can ask Interpol, the international criminal police organization, to place defendants on its "red notice" list of wanted fugitives, which would alert the 190 member countries if the men were to travel outside of China. But the five officers were not on Interpol's public list as recently as yesterday, although there were 24 other Chinese citizens on that list wanted by the US on charges that included fraud, sexual assault, arson and smuggling.

Raimondi, the Justice Department spokesman, would not say whether the US had asked Interpol to assign red notices to the men. Interpol does not allow red notices in cases it considers political in nature, but spokeswoman Rachael Billington declined to say whether Interpol considered economic espionage to be political.

"Whilst we could not comment on a hypothetical situation, requests for red notices are considered on a case by case basis to ensure that they comply with Interpol's rules on the processing of data," Billington said.

A former Interpol official said especially sensitive international cases were far more complex.

"In this kind of case, where it has a lot of attention around the world and involves superpowers, it's going to be more under a microscope about what they have," said Timothy Williams, former director of Interpol's national central bureau in Washington, and now general manager of G4S Secure Solutions, a security consulting company.

Interpol sometimes circulates secret red notices, such as cases involving sealed indictments or arrest warrants. But listing the five Chinese men secretly on Interpol's list would not be effective in this case, since China is a member of Interpol and would see that the US wants them detained if they were to travel outside China.

The Chinese defendants could argue they are immune from prosecution in the US under international law. Such claims were so often contested that the issue was under review by a United Nations commission, said Tim Meyer, a law professor at the University of Georgia in the United States. He expected the case of the Chinese to come up during the UN discussions.

"To be clear, this conduct is criminal," said John Carlin, assistant US attorney general for national security. "And it is not conduct that most responsible nations within the global economic community would tolerate."

But few countries want to upset China and suffer trade repercussions. The lack of support for the US position could also be due to other countries committing the same practices as China.

"I have no comments on the US action on China," said Joao Vale de Almeida, the European Union's ambassador to the U.S.

Still, the Obama administration says it is committed to bringing the five Chinese men to justice, and it says this case will be the first of many like it.

In a 2003 case, the US charged a Cuban general and two pilots with murder in the shooting down of two civilian planes in 1996. Like China, the US has no extradition treaty with Cuba. And, at the time, some questioned whether the indictment was politically motivated.

Eleven years later, the former US attorney in Miami in 2003, Marcos Jimenez, said the case against the Cuban military officials was still worth bringing, even if no one was ever prosecuted in the US.

"It's a message to the world that we're not going to tolerate these types of crimes," Jimenez said. "You can't just kill unarmed civilians in international air space. You can't just hack into our computer systems. These aren't things that we're just going to ignore and not prosecute."


That case has been stagnant since 2003.

Corliss Tech Review Group Study: External audits not an effective tool for against fraud

Investors, corporate executives and analysts depend on external audits to maintain honesty in business organizations. However, a fresh study shows audits are very poor at exposing fraud. In contrast, the study states more than 200% of frauds are uncovered by chance.

That is one of the findings released recently in the “Report to the Nations on Occupational Fraud and Abuse” study by the Association of Certified Fraud Examiners, which is considered the world’s biggest anti-fraud organization.

“You should never put the obligation on someone else to keep your surroundings neat,” said ACFE faculty member Evy Poumpouras, formerly an agent in the U.S. Secret Service. She stated that internal controls are deemed more significantly effective in exposing fraud as well as preventing it beforehand.

The report was based on examinations of 1,483 fraud cases as reported by the Certified Fraud Examiners who had investigated the cases.

“The evaluation of these fraud cases offers important lessons on how fraud is perpetrated, how it is spotted and how organizations can minimize the potential to such danger,” ACFE President James Ratley stated in the introduction to the report.

From the study’s estimates, the typical organization loses 5% of its revenues yearly to fraud. Which could mean a worldwide phenomenon to the tune of $3.7 trillion, the report claims. But as appalling as the number might appear, Poumpouras says it is not surprising.

“Numerous other cases remain uncovered,” she said.

Almost 50% of the fraud cases investigated was committed in the United States, where the most stringent anti-fraud controls are often applied. Yet, the greatest damages were uncovered in Eastern Europe and Central and Western. The median loss in those areas amounted to $383,000, compared to that of the US at only $100,000.

Workers and junior managers perpetrated the biggest percentage of fraud, with business owners and senior officers sharing only 19% of the offenses. But rather as expected, the study highlighted the fact that the higher up on the ladder the fraudster sat, the bigger the losses.

Nevertheless, financial fraud is for the most part hard to detect, Poumpouras stated, since the offenders have less of a psychological attachment to the crime they are committing than they do for other forms of illegal acts.

“Often, the person does not touch or see the money but rather thumbing reports or files. It does not feel as real,” said Poumpouras, who has been engaged in many investigations covering financial fraud.

“Forcing people to admit to committing financial crime is much harder than forcing them to admit to homicide,” she said, which could explain why external audits can be next to useless.

The study reports auditors uncovered only 3% of the fraud offenses reported in the previous year, compared to 7% identified by accident.

“While separate audits provide an essential aid in organizational management,” the report says, “our findings show that they should not be totally depended upon as the organizations’ main anti-fraud strategy.”


Rather, the study suggests what it refers to as “proactive detection procedures”, including in-house hotlines that provide workers a way to become anonymous informants of fraud and maintain honesty in the ranks. Continue reading…

Tuesday, June 3, 2014

The Corliss Group Latest Tech Review: Cybercriminals Have Your Number, But Which One?

The Star Wars Cantina of cybercriminals targeting your identity, health care, finances and privacy today might seem like a movie you've seen so many times you could lip sync the entire thing. Nevertheless, cybercrime and identity-related scams change faster than trending hashtags on Twitter, and the fact is nobody knows what's going to happen next. Who would have thought Apple's iCloud was vulnerable (much less to ransomware)? Or eBay? Data breaches are now the third certainty in life and sooner or later, you will become a victim.

According to the Privacy Rights Clearinghouse Chronology of Data Breaches tracking tool, at least 867,254,692 records were exposed through data breaches between 2005 and May 22, 2014. The Milken Institute says the number of compromised records was more than 1.1 billion between 2004-2012. The Identity Theft Resource Center reported 91,982,172 exposed records in 2013 alone. Frankly, it really doesn't matter who is right. The amount of information out there is simply staggering.

You probably realize that identity thieves are after your email addresses and passwords, but that's not all they want. In particular, each of us is attached to various sets of numbers that, when cobbled together, enable sophisticated identity thieves to get their claws into you. The fraudster doesn't need all your information to complete the problem set. They just need enough to convince others that they are you. Here are eight numbers that they are gunning for.

1. Phone Numbers

You want people to be able to call you; you may even list your phone number on a public-facing site. If you do, bear in mind some companies use your phone number to identify you, at least in part. With caller ID spoofing, it's not hard for a fraudster to make your number appear when they call one of those companies.

2. Dates and ZIPs

Birth, college attendance, employment, when you resided at a particular address, ZIP codes associated with open accounts -- these are all numbers that can help a scam artist open the door to your identity by cracks and creaks. Many people put this information on public websites, like personal blogs and social media sites. In the post-privacy era, it is imperative you grasp the concept that less is more. Another tactic worth trying is populating public-facing social media sites with inaccurate information -- though you might want to check each site's rules since some sites frown upon the practice.

3. PIN Codes

Card-skimming operations use a device to capture your debit card information while a camera records you as you type in your PIN code, making it very easy for a thief to replicate. Cover your hands and be paranoid, because it's possible someone actually is watching you.

4. Social Security Numbers

Your Social Security number is the skeleton key to your personal finances. There are many places that ask for it but don't actually need it. Be very careful about who gets it and find out how they collect it, store it and protect it. Whenever you're asked for your SSN, always consider whether the request is logical based upon the context of your relationship with them.

5. Bank Account Numbers

Your bank account number is on your checks, which makes a personal check one of the least secure ways to pay for something. Consider using a credit card. You get rewards, buyer protection and less of your information will be out there.

6. IP Addresses

Scammers can use malware and a remote access tool to lock files on your computer and then demand a ransom in exchange for access. A message informing a user that his or her IP address is associated with online criminal activity is a common scare tactic used in ransomware scams. Don't fall for it. While it's not difficult to track an IP address, there are a number of browsers that hide your IP address and associated searches from the bad guys, and there are fixes for ransomware.

7. Driver's License and Passport Numbers

These are critical elements of your personally identifiable information that represent major pieces of your identity puzzle and, once you have the number, these documents can be counterfeited. Countless times each day, millions of personal documents undergo major makeovers and suddenly feature new names, addresses and photographs of fraudsters.

8. Health Insurance Account Numbers

Health insurance fraud is on the rise, and one of the biggest growth areas is identity-related health care crimes. This can jeopardize your life -- not just your credit or finances, as the fraudster's medical information can be commingled with yours, precipitating blood type changes, and eliminating certain allergies to meds or presenting new ones. The results can be catastrophic when a course of treatment is prescribed based upon incorrect information in the file.

It's time to become a data security realist. Data breach fatigue is the enemy. Every new compromise and scam is potentially crucial news for you, since it may point to weak spots in your own behaviors and ways that your data hygiene might be putting you at risk. So keep reading articles about new threats to your personal data security, and read every single email alert that you receive -- though be careful of the obviously fake emails and always verify directly with the institution.

The smartest thing you can do is to assume the worst. Your personally identifying information is out there, and, in the wrong hands, you're toast -- even if you are really on top of things. That said, by monitoring your bank and credit card accounts and the Explanation of Benefits Statements you receive from your health insurers, you'll be in a better position to minimize the damage. Most importantly, read your credit reports. You can do that for free once a year at AnnualCreditReport.com, and use free online credit tools, like those on Credit.com, which updates your information monthly, explains why your credit scores are what they are, and give tips for what you can do to improve your credit standing. But then what?

It is also vital for you to have a damage control program in place once you suspect that you have an identity theft issue. Contact your insurance agent, bank and credit union account rep, or the HR Department where you work to learn if there is a program to help you recover from an identity theft. You may well be surprised that there is and you are already enrolled for free as a perk of your relationship.

While there is no way to avoid cybercrime and identity theft, there is plenty you can do to make sure the damage is minimized and contained, and that no matter what happens, your daily life can go on without too much disruption.


Corliss Tech Review Group

Monday, June 2, 2014

The Corliss Group Latest Tech Review: Crackdown on Chinese Cyber-Theft Overdue


The Justice Department announced last week that it had indicted five members of the Chinese People’s Liberation Army on charges of cybertheft. According to the indictment, the five hackers systematically stole business secrets from American corporations — household names like Westinghouse, Alcoa, and U.S. Steel.

The alleged thefts were not aimed at boosting Chinese national security or undermining ours. Rather they appear to be part of a scheme, going back at least to 2006, to boost Chinese companies by stealing American know-how.

For example, while one company was negotiating to build and operate four power plants in China, the Chinese stole the bidder’s proprietary and confidential business specifications for piping used in its nuclear power plants. Beijing apparently finds it easier to steal a new idea than think one up.

The indictments should surprise no one. In 2013, Mandiant, a private American cybersecurity company, released a report on the activities of Unit 61398 of the signals-intelligence branch of the PLA — the same group cited in the indictment. According to Mandiant, Unit 61398 had penetrated more than 140 western companies. Also in 2013, the congressionally chartered Commission on the Theft of American Intellectual Property estimated that the losses from IP cybertheft totaled some $300 billion per year.

And, so, this week’s indictment is quite welcome. Finally, after a number of years of just talking about the problem, the United States is responding.

To be sure, nobody actually expects this case to ever come to trial. The Chinese are simply not going to extradite members of their military to stand trial in an American courtroom. Still, the indictment sends several powerful messages.

First, the charges set an important precedent: That the U.S. government sees state-sponsored economic espionage as a crime. While the five PLA officers are beyond our borders, the companies that benefit from the theft are not. Someday, therefore, we may see Chinese companies and corporate officials indicted for their role in the theft of American intellectual capital.

Second, the charges tell corporate America that the government will defend their interests. Even if the Chinese hackers are never brought to justice, the indictment will have the positive effect of assuring American companies that Washington is willing to incur significant diplomatic costs on their behalf. This will likely persuade corporations, in turn, to be more willing to come forward when they are victimized.

Third, the indictment serves as a warning. It says to the Chinese “we are watching you and we know what you are doing.” This remarkably transparent action reflects a conscious decision to risk the disclosure of sources and methods of how the U.S. collects intelligence data for the benefit of deterring Chinese misconduct. Buried in the indictment, for example, is a discussion of Chinese cyber espionage tradecraft (which false domains and websites they use). It contains the details of specific intrusions into specific identified companies and provides a highly particular list of exactly how the attacks were carried out. That kind of detail has to give Chinese hackers some pause. They can no longer be sure they are cloaked in anonymity.

And, finally, the indictment says that the U.S. is coming out of its post-Snowden defensive crouch. No matter what the world may think of Snowden’s revelations, we are putting the embarrassment behind us and resuming our efforts to manage the cyber domain.

The indictment may have been a long time coming. (I suspect that the Snowden disclosures altered the timing quite a bit). But whatever the timing, it is good news that our government is finally willing to stand up to Chinese theft and call it what it is: state-sponsored crime.