Riot police raided a 30th birthday barbecue because they thought the organiser, who had invited his friends via Facebook, was staging a rave.

Four police cars, a riot van and a helicopter moved in on Andrew Poole’s gathering which was taking place in a field owned by a friend.

The coach driver had invited 17 guests to an ‘event’ on his social networking page by private invitation and was about to light the barbecue when the gazebo suddenly started flapping wildly and the sound of chopper blades filled the air.

A police helicopter circled the field several times before four police cars and a riot van stormed into the field in a small village near Sowton, Devon.

Eight officers wearing camouflage trousers and body armour then jumped out and ordered the party to be shut down or everyone would be arrested.

Andrew, ofExeter, Devon, said: ‘It had started to rain so we had gone in under the gazebo. All of a sudden there was this noise in the sky – I honestly couldn’t believe it.

‘The thing then hovered over us for about 25 minutes, watching 15 people eat. They told us to take down the sound system and said everybody’s got to leave.

‘It was 4pm and we hadn’t even plugged the music in yet. We tried to reason with them, and even offered for them to take the power lead for the sound system, but they were having none of it.

‘It was on private land. We were nowhere near anyone. We weren’t even playing any music. What effectively the police did was come in and stop fifteen people eating burgers.’

Andrew had spent £800 for the hire of the generator, marquee and food. The guests arrived at 3pm but soon after a police helicopter generated a huge dust cloud which covered his BBQ in debris.

Andrew said: ‘The police had full-on camouflage trousers on and body-armour, it was ridiculous. There was also several plain-clothes officers as well.

‘I told them it was my 30th birthday. I said “this is a once in a lifetime event for me, please don’t ruin it”. But they kept on insisting I had been advertising it as an all-night rave on the internet.

‘But I’d created an event, and 17 people had confirmed as guests, I did put the times on it as “overnight” in case people wanted to sleep-over.

‘They were still banging on saying it was advertised on the internet. They wouldn’t accept it wasn’t a rave. It was in a completely isolated field.

‘We’d actually faced the speakers away from the village just in case nosy-neighbour types complained. But someone must have seen us putting up the marquee and phoned the police.’

A spokeswoman for Devon and Cornwall police said the helicopter was deployed for less that 20 minutes at a cost of around £200.

She said local residents were concerned due to previous raves having reportedly taken place in the area with loud music and traffic disruption into the early hours.

She said: ‘The decision to close down a rave or illegal music festival is not taken lightly.

‘On this occasion, we were extremely concerned how the event had been advertised on the internet as an all-night party and it was therefore necessary to take the appropriate steps.

‘Had it gone ahead, it is likely that far more of our resources would have been used to police the event and there would have been considerable disruption to neighbouring properties.

‘It was fortunate that the force helicopter was able to fly over the site as they were returning from another task.’

Source: http://www.dailymail.co.uk/news/article-1200310/Police-raid-30th-birthday-barbecue-man-used-Facebook-invite-friends.html#ixzz0NCgOORRR

The July/August 2009 (Vol. 7, No. 4) issue of IEEE Security and Privacy is now online

FROM THE EDITORS: New Models for Old by Marc Donner

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.99

INTERFACE: Letters to the Editor

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.95

NEWS BRIEFS: James Figueroa

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.100

INTERVIEW: Silver Bullet Talks with Virgil Gligor by Gary McGraw

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.106

SPECIAL REPORT: Lifting the Veil on Cyber Offense byHerbert Lin

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.96

PIXEL-COUNT ATTACKS: CAPTCHA Security: A Case Study by Jeff Yan, Ahmad Salah El Ahmad

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.84

SECURE DATA SANITIZATION: Disposal of Disk and Tape Data by Secure Sanitization by Gordon F. Hughes, Tom Coughlin, Daniel M. Commins

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.89

ACCESS CONTROL: Privacy-Aware Role-Based Access Control by Qun Ni, Elisa Bertino, Jorge Lobo, Seraphin B. Calo

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.102

INTERNET SECURITY: Security in Open Source Web Content Management Systems by Michael Meike, Johannes Sametinger, Andreas Wiesauer

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.104

CYBERSECURITY: Making the Best Use of Cybersecurity Economic Models by Rachel Rue, Shari Lawrence Pfleeger

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.98

IT ALL DEPENDS: Data Security in the World of Cloud Computing by Lori M. Kaufman

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.87

EDUCATION: Human Relationships: A Never-Ending Security Education Challenge? by Janne Hagen

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.92

PRIVACY INTERESTS: Deconstructing the Privacy Experience by Betsy Masiello

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.88

CRYPTO CORNER: Green Cryptography: Cleaner Engineering through Recycling by Justin Troutman, Vincent Rijmen

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.91

BASIC TRAINING: Predictable Surprises by Ronda Henning

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.101

SECURE SYSTEMS: Securing Cellular Infrastructure: Challenges and Opportunities by Patrick Traynor

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.103

SECURITY & PRIVACY ECONOMICS: Incentive-Centered Design for Security by Jeffrey K. MacKie-Mason

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.94

BUILDING SECURITY IN: Software Assumptions Lead to Preventable Errors by Andy Steingruebl, Gunnar Peterson

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.107

CLEAR TEXT: Security, Group Size, and the Human Brain by Bruce Schneier

http://doi.ieeecomputersociety.org/10.1109/MSP.2009.105

We’ve just gotten word that development-outsourcing site Elance has suffered a security breach, compromising some user information that included names, addresses, phone numbers, and location (no financial information was taken).

Multiple users have received the following letter:

It has recently come to our attention that certain Elance user information was accessed without authorization, including potentially yours. The data accessed was contact information — specifically name, email address, telephone number, city location and Elance login information. This incident did not involve any credit card, bank account, social security or tax ID numbers.

We have remedied the cause of the breach, and are working with appropriate authorities. In the meantime, please take extra precautions in protecting your Elance account. For example, do not provide your login information on any site that is not http://www.elance.com, and NEVER give out passwords by email, over the telephone or on websites that are not the Elance site.

We sincerely regret any inconvenience or disruption this may cause.

For more details and ongoing information about this, please visit this page in our Trust & Safety center: http://www.elance.com/p/trust/account_security.html

Michael Culver
Vice President
Elance

Elance’s security alert site reveals that the data was taken by hackers who discovered a security hole on the site:

The hackers discovered a security hole on an unprotected page that enabled them to access a data table that contained contact information including name, email address, telephone number, city location, and username, and that contained protected versions of user passwords, in an unreadable format called a one-way hash. Their attack did not access personal financial information such as credit card, bank account, social security or tax ID numbers.

In a bizarre twist Elance’s security site says that some of the stolen user data is now appearing on OutsourcingRoom.com, a competing service. Elance writes that it is working to have the data removed.

This is only the latest in a recent string of security breaches on major web services. It’s obviously nearly impossible to guard against every kind of online threat, but if we’re going to become comfortable having our entire computing experience in the cloud, things need to change.

Source: http://www.techcrunch.com/2009/07/16/elance-hit-by-security-breach/

n order to comply with Canadian privacy law, Facebook must take greater responsibility for the personal information in its care. That’s not what we said, it’s what Canada Privacy Commissioner Jennifer Stoddart says in a statement following an investigation into the social network’s privacy policies and practices.

That investigation was reportedly prompted by a complaint from the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (ahem), and identified “several areas where Facebook needs to better address privacy issues and bring its practices in line with Canadian privacy law”.

(Update: Facebook statement below)

You may want to read our post on “The Looming Facebook Privacy Fiasco” for more context. We also recently reported on independent European advisory body on data protection and privacy to the EC Article 29 Working Party’s arguments that social networks like Facebook, Twitter and MySpace need more government regulation in Europe.

The organization and Commissioner’s main concern is that Facebook provides confusing or incomplete information about its privacy practices, like not giving users to opportunity to complete wipe out their accounts instead of merely deactivating them. Stoddart also criticizes Facebook’s policy of indefinitely keeping the personal information of people who have done just that. Another issue that gets raised in the report is the sharing of users’ personal information with third-party developers creating Facebook apps, for which the report claims Facebook lacks adequate safeguards to restrict them from accessing private profile information.

Recommendations to Facebook included the adoption of a retention policy whereby personal information in deactivated accounts is deleted after a reasonable length of time, although it doesn’t specify what period would be within reason exactly. According to Canada’s private-sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), organizations must retain personal information only for as long as is necessary to meet appropriate purposes.

The report also recommends a number of other changes, including technological measures to ensure that developers can only access the user information actually required to run a specific application, and also to prevent the disclosure of personal information of any of the user’s friends who are not themselves signing up for an application.

The Office of the Privacy Commissioner will review the actions Facebook takes to comply with the recommendations in a month, and hints that Stoddard is empowered to go to Federal Court to seek to have her recommendations enforced.

One tidbit of information in the statement: Facebook apparently boasts about 12 million Canadian users.

The full report can be found here.

Update: Facebook’s response:

Facebook is pleased that the Canadian Federal Privacy Commissioner has dismissed the most of the inaccurate claims brought by CIPPIC, and that we were able to collaboratively resolve other issues raised in the complaint.

As part of our continued leadership in developing privacy tools that advance user control over their information, Facebook will soon be introducing a number of new additional privacy features to its service that we believe will keep the site at the forefront of user privacy and address any remaining concerns the Commission may have. In the meantime, we will also continue our efforts to work with the Canadian Federal Privacy Commissioner to address the outstanding areas highlighted in the report and will continue our efforts to raise awareness of the privacy controls on Facebook.

Source: http://www.techcrunch.com/2009/07/16/canadian-privacy-commissioner-says-facebook-is-full-of-holes/

The Mail on Sunday said his wife, Lady Shelley Sawers, put details about their children and the location of their flat on the social networking site. The details were removed after the paper contacted the Foreign Office. Foreign Secretary David Miliband denied security had been compromised, saying: “You know that he wears a Speedo swimsuit. That’s not a state secret”. Sir John Sawer is currently the UK’s ambassador to the United Nations and is due to take up his new post in November. But Conservative MP Patrick Mercer, chairman of the counter-terrorism sub-committee, expressed concerns about the possible security risk. He told the BBC: “It raises all sorts of worrying issues about the… personal life, in particular the location of flats, transport details, movement details, of an individual who is our most senior counter-terrorism officer abroad.”

“A great deal of taxpayers’ money has been spent over the past several decades making sure he and his family are protected from security compromises. Well, it doesn’t seem to be very relevant anymore, does it?”
He added: “It’s distressing and worrying therefore that these sorts of details should be appearing in the public domain. I would have hoped these sort of mistakes would not have been made by people like that.”
Liberal Democrat Foreign Affairs spokesman, Edward Davey, told the Mail on Sunday he wanted Gordon Brown to launch an inquiry into whether the disclosures have compromised Sir John’s ability to take up his MI6 post appointment.

Source and Full story: http://news.bbc.co.uk/2/hi/uk_news/8134807.stm

See also: http://www.mailonsunday.co.uk/news/article-1197562/MI6-chief-blows-cover-wifes-Facebook-account-reveals-family-holidays-showbiz-friends-links-David-Irving.html

Facebook’s presentation on their privacy settings: http://www.businessinsider.com/facebooks-new-twitter-squashing-privacy-settings-2009-7