Asset Protection BLOG - Mark Nestmann

What Your PC Knows About You

If someone could secretly stand behind you and monitor everything you've done on your PC, what would they discover about you that you would prefer to keep private?  Thanks to new technologies that secretly track everywhere you go on the Internet, that's an appropriate comparison of the threat you face unless you take advance precautions.

Perhaps you've never visited a Web site you wouldn't want your spouse, your children, your neighbors, or the FBI to know about.  Perhaps you really do have "nothing to hide."  But if you do, you'll want to understand the threat to your privacy—and what you can do to protect yourself.

The centerpiece of this threat is a tracking technology that records what Web sites you visit, what links you click on, and what types of search engine questions you ask.  If you've entered personal information into applications that use these technologies, that data is stored as well.  All of it is written to hidden directories on your hard disk.  And there it stays—permanently—unless you know how to delete it.

Usually what's recorded is innocuous.  You might not mind that your hard disk has a record of the movies you've rented, the fact that you're interested in photography, or that you want to take pilot lessons.  And you might not object to the fact that the companies that create these hidden directories sell the information.  For instance, a company selling photographic supplies would surely be interested in presenting an advertisement for its services to someone with a proven interest in photography.

However, perhaps your interests are a bit more controversial.  Or even if they're not, perhaps someone with access to your PC has less conventional preferences than you.  In that event, the data in the hidden directories could possibly come back to haunt you, should your PC ever be compromised—or searched by law enforcement.

Say, for instance, that you—or someone with access to your PC—watch a controversial video on the Internet.  Guess what?  The Web site serving up the video to your browser most likely plants a tracking beacon on your hard drive, where it stays—potentially, forever.  Erasing "cookies" in your browser will NOT delete these beacons!

The largest offender in this regard is probably a program called Adobe Flash Player (AFP).  Many Web sites use AFP to deliver audio and visual content.  But AFP also creates a hidden directory on your hard disk to track the Web sites you visit, especially those with interactive or multimedia features.  Companies that plant the beacons use them to personalize your browsing experience, and also sell the data they contain to direct marketing companies. 

Since you can't delete these files from your browser, the most practical way to deal with them is to install a browser add-on program to manage and delete them.  One such program is "Better Privacy," an add-on for Firefox.  You can download it at https://addons.mozilla.org/en-US/firefox/addon/6623/.  I've configured Better Privacy to delete all AFP beacons when I shut down my browser.

I also suggest that you configure AFP to minimize tracking altogether.  You can adjust its settings using a virtual control panel at: http://www.macromedia.com/support/documentation/en/flashplayer/help/help09.html. 

I've adjusted the settings on my PC to always deny access to my PC's camera or microphone, never storing any content, and deleting all records of Web sites I've visited that use AFP.  Those settings, together with the Better Privacy add-on, seem to have rid my PC of "beacons"—at least those from AFP.  These settings limit functionality on some Web sites, but so long as you configure AFP to allow programs to ask you for permission to store content, you can control which ones have access to your PC.  When you exit your browser, Better Privacy deletes them.

Incidentally, none of AFP's tracking software violates any U.S. law; at least none of which I'm aware.  And don't look to the government for help—law enforcement agencies surely find beacons on your PC a highly informative tool to track your Web browsing behavior.

With big business and big government collaborating to invade your online privacy, you have only one resource to depend upon—yourself.  So if you don't want permanent records of your online life residing on your hard drive, don't call your Congressman for help.  You alone must take responsibility for protecting your online privacy.

Copyright © 2010 by Mark Nestmann

What's Your Identity Worth?

Identity theft has met the law of supply and demand.  The law of supply and demand won.

Yes, identity theft is now so pervasive that the value of individual identities has fallen sharply.  What's more, a wealthy person's identity, with perfect credit, isn't worth much more than a deadbeat's identity.

That value, by the way, is about $10, perhaps a little more.  Just a few years ago, the black-market price for a pilfered identity was $100 or more.  But today, hackers are stealing so many more identities, that the value of each one has sharply declined.  

Indeed, about 11 million Americans suffered some form of data compromise in 2009.  Many of these victims suffered nothing worse than fraudulent charges on a credit card, but identity theft is a crime with the potential to turn your life upside down.  (If you have any doubt, read these horror stories).

Most identity theft stems from lax security at department stores, credit card processing centers, hotels, the military, and universities.  

If you serve in the military or attend a university, you can't do much to prevent identity theft stemming from lax security at these institutions.  Pay cash at department stores and hotels to prevent hackers from picking your credit card number out of a poorly secured data stream.  At hotels, though, you'll probably need a credit card to check in.  Pay cash in advance, and ask the hotel clerk not to authorize any payment on it unless there's an outstanding balance.

An increasing number of hackers target individual victims over the Internet.  Identity thieves may pose as your friend on Facebook, and then steal whatever personal information you reveal.  They can also trick you into visiting a fraudulent Web site posing as a legitimate one.  This is common with online banking scams, where identity thieves drain your account after stealing your log-on password.  Then they try to steal enough personal information to apply for credit in your name.  

The antidote for dealing with online identity theft is to be skeptical.  Do you really need 14 million friends?  That's the approximate number of friends Lady Gaga now has on Facebook.  Ask strangers who want to be your friend, "How do you know me?" If your new "friend" tells you that another friend referred them to you, ask that friend for confirmation.

A common ruse on or off social networking Web sites is an e-mail with an infected file attachment.  If you click on the attachment, a remote administration "Trojan Horse" program may take over your PC.  From that point forward, the Trojan may send everything you type or view to points unknown.

Another common scam is a bogus email, allegedly from a bank or online merchant.  The message contains a link routing you to an authentic-looking, but phony, Web site.  There, you're prompted to enter sensitive information such as your password, your Social Security number, etc.  A hacker may even plant malicious software in the servers that direct traffic on the Internet.  Even if you type in the correct address of a website (e.g., of a bank), the software sends you to a bogus one, where thieves can steal your personal information.  

Protect yourself by never clicking on unfamiliar attachments or entering personal information into an online form in response to an unsolicited e-mail message.  If you're not sure, call the company sending you the e-mail.  Don't call any number listed in the message, either.  It's probably a fake listing.  Instead, call the number on any statement the company has sent you, or look it up.  

Fortunately, it's difficult even for the best hackers to duplicate the "look and feel" of a commercial website.  Also, be alert to misspellings.  Another tip-off is if the website doesn't display the "lock" icon at the bottom of your screen.  If you have any suspicion the website isn't real, again, call the company.  

More advanced "spyware" installs itself on your PC as soon as you view an infected Web page in your browser or e-mail reader.  Protect yourself against this attack by using a free program called No-Script.  It's available for Firefox, and it preemptively blocks all potentially dangerous content from being loaded into your browser.  You can authorize individual components of the Web page to load by right clicking on the No-Script icon.  For Web sites you trust completely, instruct No-Script to load the entire page.

Identity theft is big business.  It's not going away anytime soon, either, because both online marketing companies and the government find the data you leave behind very useful.  So don't rely on the government to come up with a "solution" to identity theft.  Rely on yourself.

Copyright © 2010 by Mark Nestmann

Encryption Works!

If you use a technology called "encryption" properly, not even the government can read the information on your computer.

With encryption software, no one but you and your intended recipient can read your e-mail messages, text messages, instant messages, etc.  You can even encrypt your entire hard disk to protect everything on your PC from prying eyes.

Occasionally I encounter naysayers who tell me I'm wrong.  "The FBI, CIA, or NSA can unlock any type of encryption," they say.  "Relying on encryption just raises your profile." 

I'm not a computer expert, and I certainly don't know what capabilities the FBI and U.S. intelligence agencies have to decrypt encrypted information.  But in at least one case, even the FBI couldn't decipher data on a PC protected by an encryption program called "TrueCrypt."

In July 2008, Brazilian federal police seized a computer owned by a banker named Daniel Dantas.  The seizure occurred in connection with Dantas' arrest for money laundering, tax evasion and racketeering. 

In the meantime, police were trying to decrypt Dantas hard disks, and getting nowhere.  They turned to the FBI for assistance in late 2008.  After trying to break the code for more than a year, the FBI returned the hard drives to Brazilian police earlier this year, with the encryption intact.  The programs Dantas used to encrypt the hard drive were TrueCrypt and another, unspecified encryption program.

Apparently investigators were unable to get past the passphrase that appears when a PC's entire hard disk is encrypted.  To break the password, both Brazilian authorities and the FBI used a "dictionary" attack.  This involves successively trying all the words in a list, often taken from a dictionary or simple variations of words in a dictionary.  Dictionary attacks often succeed because many PC users employ short, easy-to-remember passphrases.  Obviously, Dantas was more sophisticated than most computer users.

However, Dantas wasn't as successful staying out of jail.  Although his data remains securely encrypted, in December 2008, he was convicted of attempted bribery of a police officer and sentenced to 10 years in prison.  In this case, at least, Dantas would have done better to rely on technology than on human greed.

Copyright © 2010 by Mark Nestmann

When Cameras are Outlawed, Only Outlaws will Have Cameras!

If you witness police misconduct and record it as a video on your phone or camera, you won't be welcomed as a hero.  In several U.S. states, you could be subject to a long prison sentence. 

In recent years, dozens of videos documenting police misconduct have been posted on YouTube.  But prosecutors haven't generally punished the offending cops.  Increasingly, they're arresting the individuals who posted the videos.

The charge?  Illegal wiretapping.  Yes, wiretapping—what the NSA does with impunity and without a warrant is illegal for us to do when we witness police abuse.

At least two states—Massachusetts and Illinois—make it illegal to record any on-duty police officer in any situation.  It doesn't matter if the officer is in the process of beating someone to death.  It doesn't matter if the recording is in your own home, and the police have just busted down your door in an illegal search.  If you record the interaction, you can go to prison. 

In ten other states, "all parties" must consent in order for a private person to make a recording of a conversation or personal encounter.  Since a police officer acting abusively isn't likely to give you permission to record the event, if you do so, you could be violating the wiretap statute—and be subject to a long prison sentence. 

In Illinois, for instance, a street artist recorded his own arrest for selling artwork without a peddler's license.  He now faces up to 15 years in prison.

Arresting police whistleblowers is a nationwide trend.  And the courts approve.  For instance, the Massachusetts Supreme Court upheld the conviction of a man arrested for recording a police encounter.  Defendant Michael Hyde used the recording to file a harassment complaint against police.  Instead, he was convicted of illegal wiretapping.  While he was sentenced to only six months of probation, he could have faced a much longer prison term.

Cameras, in effect, are like guns.  Point a gun at a police officer and you'll be arrested.  Point a camera at a police officer and you'll be charged—and likely convicted—of illegal wiretapping.

The fact that wiretapping laws are being used against private citizens is richly ironic, because they were enacted to protect citizens against government oppression.  These cases turn that notion on its head because those trying to protect themselves or others from official misconduct ends up being prosecuted.

Since we’re living in a surveillance society where the government continuously monitors our finances, our communications, and our movements, shouldn't we have the right to turn the tables and, in effect, "watch the watchers?"  Yes, but police and the courts disagree.

Copyright © 2010 by Mark Nestmann

Preparing for a U.S. Border Crossing

If you're planning to leave—and especially to enter—the United States, you need to take several precautions before you do so.

That's because Customs and Border Patrol (CBP) agents can seize and copy the contents of any electronic device you carry across a U.S. border.  That includes your laptop, your cell phone, your USB flash drives, your digital camera, etc.  Agents don't need probable cause or even reasonable suspicion to conduct a search of your electronic data—just "gimme."  They can copy the data for investigative purposes and then use that information against you in a subsequent criminal case.

Fortunately, such searches are relatively rare.  For instance, logs from the Department of Homeland Security show that agents searched 1,000 laptops between October 2008 and August 2009.  Only 46 of these searches were "in-depth."  From these searches, five travelers were found to have "illicit information" on their laptops.  During this nine-month period, 221 million travelers came through U.S. ports of entry.

Since the odds are low you'll be targeted for a search, you may be tempted to run the CBP gauntlet without taking precautions to protect your data.  That would be a mistake, particularly if your laptop or other electronic device contains any information that you'd prefer not to share. 

For instance, if you're an attorney, your laptop may contain information subject to attorney-client privilege.  If it does…well, too bad.  According to published CBP guidance, "a claim of privilege …does not prevent the search of a traveler's information at the border."  Or perhaps your smartphone contains trade secrets or other data you'd rather not share with the U.S. government.  But when you carry it across a U.S. border, you've given the government permission to review that data and retain it indefinitely. 

The real problem, of course, is that now this policy is in place, it could be greatly expanded.  Of course, this would be impractical without massive increases in CBP's budget—but another 9/11-type attack might be all that's needed to spur Congress into action.

To avoid a border inquisition, the best precaution is not to carry any electronic devices across a U.S. border.  For most people, this isn't practical, so the next-best strategy is to carry only "sanitized" devices.

For instance, you could purchase an inexpensive laptop and use only for international travel.  Keep nothing on it except for the operating system and program files.  Before you cross the border, "sanitize" it using a program such as Window Washer (http://www.webroot.com). When you return to the United States, securely "wipe" any confidential information off your hard drive, along with the "free space," using a program like PGP Desktop  (http://www.pgp.com).

Back up your data to an online backup site such as Carbonite (http://www.carbonite.com).  Encrypt the data before uploading it, using a product such as PGP Desktop or True-Crypt (http://www.truecrypt.org).

Buy an "unlocked" tri-band cell phone with a replaceable SIM card for international travel.  When you arrive in a new country, purchase a domestic SIM card from a local phone dealer.  This not only protects your privacy at the border, but also eliminates roaming charges.

If you must carry sensitive data across the border, encrypt whatever device containing that data.   However, CBP officials may demand that you decrypt any encrypted files before you proceed.  Refuse, and you might be detained until you agree to decrypt the device for inspection.  If you're a foreign national, you might be turned away and informed that you won't be permitted to re-enter the United States.  (One possible solution: True-Crypt lets you type in a special access code that provides access only to part of your hard drive.  The remainder of your data remains protected in a hidden hard disk partition.)

Blackberries and other smartphones come with built-in encryption.  However, many smartphone encryption systems have significant weaknesses.  A better solution (unfortunately only for Windows mobile smartphones) may be PGP Mobile (http://www.pgp.com/products/mobile/index.html).

The CBP believes these rules are necessary to investigate terrorism, child pornography, etc., but I'm not so sure.  For instance, if you were a terrorist, would you really bring your laptop across the border with your plans to blow up the White House?  No, you'd simply e-mail yourself the plans to blow up, poison, or incinerate whatever you wish to target.  As with most anti-terrorism initiatives, this one does little or nothing to fight terrorists.  It merely inconveniences law-abiding travelers. 

Welcome to the United States!

Copyright © 2010 by Mark Nestmann

My New Smart Meter

Last week, I experienced a momentary power interruption at my home in Phoenix.  I thought nothing of it; these sorts of things happen occasionally here.

Later that day, I noticed a note on my door.  It was from the electric company and apologized for the momentary power outage.  The reason the power had to be temporarily disconnected, it said, was so the company could install a "smart meter."  I walked around to the where the meter is located and confirmed that a shiny new meter was in place. It looked much nicer than the old one.

Why had the electric company installed the meter?  According to the note, it would no longer be necessary for someone to come read the meter monthly, and then send me a bill.  Now, the electric company could read the meter remotely and generate the bill automatically.  By reducing labor costs, I would benefit with lower bills, or at least with electricity rates not increasing as quickly.

However, my smart meter doesn't merely tally up how much electricity I consume and send me a bill each month.  It also has two-way communication.  The electric company can actually query my smart meter and track my electricity consumption minute-by-minute.  When I turn on the stove at night, the electricity company knows I'm preparing dinner.  When the water heater comes on, it knows I'm taking a shower.  (Click here to see a "load signature" from a typical home.)

The electric company can use this information for many purposes.  If I use "too much" energy compared to my neighbors, it can send me a note suggesting ways to conserve.  It can also sell this information to anyone it chooses.  Under U.S. law, I have no "expectation of privacy" to information I voluntarily turn over to someone else.  And by signing up for electricity service, I have "voluntarily" given the electric company permission to use this information any way it chooses. 

For instance, it could sell the information to my insurance company, who could charge me a higher rate for auto coverage if electrical records indicate a spike in electricity use shortly after bar-closing time in Arizona.  After all, I might have driven while intoxicated, then arrived home and turned on the television.  If the "electrical signature" the company receives from my home shows large spikes consistent with certain types of lighting, it may notify police of its suspicions that I'm cultivating marijuana there.  And if I begin buying "smart appliances," my smart meter will interact with my smart appliances to track electricity consumption per appliance. 

Now that I have my very own smart meter, I'm apparently on the cutting edge.  Only about eight million smart meters have been installed in the United States, but the Obama administration wants 50 million more installed in the next five years. 

What if you don't want your electric company to track your electricity consumption minute-by-minute?  That's just too bad.  Just keep that in mind next time you switch on the lights for your basement "grow op."

Copyright © 2010 by Mark Nestmann

Internet Telephony: Cheap, but NOT Private

Only a few years ago, it seemed like a dream: place—or receive calls—from anywhere you have an Internet connection, for only a few dollars a month—or for free.  With a technology called "voice over Internet Protocol," or VoIP, you now can.

VoIP technology chops your phone conversations into digital packets and sends them over the Internet. Once the packets arrive at their destination, they're reassembled as speech.  Sound quality isn't yet as good as ordinary phone calls in many instances, although it's rapidly improving.  Since VoIP largely circumvents traditional telephone carriers—and phone lines—it is saving users billions of dollars in fees and connection charges. 

All you need to begin is a computer, a high-speed Internet connection, a pair of headphones, and software facilitating the process.  Virtually all telephone carriers, and many independent companies, now offer VoIP services.

Unfortunately, VoIP suffers from the same security vulnerabilities as any communication over the Internet.  For instance, if you log on to the Internet at a coffee shop, plug in your headset, and start making telephone calls, it's relatively easy for an eavesdropper within range of the same wi-fi signal to listen in.  This makes eavesdropping on VoIP calls significantly easier than monitoring calls on landlines or cell phones.

Hybrid telephone technologies such as Google Voice that combine traditional and Internet-based telephony have also become available.  These services provide numerous user conveniences, but often at the expense of privacy.

Google Voice, for instance, assigns you a single number that can be forwarded to your home, office or cell phone.  You can originate calls from any of these devices and have your Google Voice number show up instead on the recipient's caller ID.  The creepiest feature is that the service allows you to record calls and automatically generates a call transcript that you can download.  And it does most of this for free.

But what of privacy?  In return for these features, you give Google access to enormous amounts of information about your life.  Google has recordings of your telephone conversations, your voice mails, voiceprints of those people calling you matched to an incoming number, and a complete list of incoming and outgoing calls.  Your voice transcripts even appear in search engine results, unless you turn off this feature.

One of the most obvious ways Google might use this data is to serve you targeted ads based on voice transcripts.  This is already part of its G-Mail service.  Even if Google has no intention of using this data for any nefarious purpose, what's to stop the FBI from issuing it a "national security letter" (a secret subpoena that can't be disclosed to targeted persons or businesses) demanding that it turn over records on particular subscribers?  In addition, I have no doubt that with this much data available, hackers will target Google Voice to extract data from its archives.

How can you protect yourself?  As with so many other aspects of electronic communication, the solution is to encrypt your VoIP conversations.  One of the best-known VoIP systems is Skype (http://www.skype.net), which automatically encrypts conversations between Skype users.  However, in 2008, an Austrian government official revealed that monitoring Skype conversations presents "no particular problems."  If this is true, it means police in other countries are probably already monitoring Skype conversations.  Still, Skype is a good start to protect your conversations against casual eavesdropping.

A better solution may come from civil liberties hero Philip Zimmermann.  In the 1990s, Zimmermann almost went to prison for developing Pretty Good Privacy (PGP), one of the first effective and trusted programs to encrypt e-mail messages.  Zimmermann has developed a program called Zfone (http://www.zfoneproject.com) to encrypt VoIP calls.  In an effort to demonstrate that there are no back doors, Zimmermann has made Zfone's source code publicly available for review by experts.  Zfone is now compatible with a variety of VoIP products, including the popular "MagicJack" (http://www.magicjack.com).

It's up to you to decide whether or not to encrypt your VoIP communications.  But if you decide not to, don't say anything you wouldn't want printed on the front page of The New York Times—or to appear in a criminal indictment.

Copyright © 2010 by Mark Nestmann

Congress Inveighs Against Surveillance Abuses—in China

It's great to know that our elected representatives are vigilantly guarding civil liberties.  Only, they're  much more concerned about surveillance in other countries, not here in the USA.

Case in point: China.  Over the last few weeks, congressional civil libertarians have revived legislation that, if enacted, would forbid U.S. companies from selling electronic surveillance equipment to governments that spy on their citizens.

H.R. 2771, the inspirationally named "Global Online Freedom Act" is intended:

"To prevent United States businesses from cooperating with repressive governments in transforming the Internet into a tool of censorship and surveillance, to fulfill the responsibility of the United States Government to promote freedom of expression on the Internet, to restore public confidence in the integrity of United States businesses, and for other purposes."

That's great!  Except that all ten sponsors of H.R. 2771 voted two years ago to legalize warrantless surveillance of American's electronic communications, in the infamous "Foreign Intelligence Surveillance Act (FISA) Amendments Act of 2008."  What's more, they also voted to prevent prosecution or lawsuits against any of the telecommunications companies that participated in illegal warrantless surveillance prior to the enactment of the FISA bill.

Surveillance at home is A-OK.  But when it comes to other governments surveiling their citizens—well, we can't have that, now can we?

There's no question that countries like China repress political opponents more vigorously than the United States.  But before Congress begins criticizing other countries' human rights record, it needs to look in the mirror.  If it's so concerned about surveillance abuses, why not repeal the FISA Amendments Act and return the law to where it was when the Bush administration entered office in 2001?  The earlier law, while hardly perfect, at least required the government to obtain a warrant to eavesdrop on the electronic communications of Americans. 

That won't happen, of course.  Barack Obama, who swept into office campaigning against the surveillance abuses of the Bush administration, now claims even wider inherent authority to eavesdrop on Americans than Bush.  Indeed, the Obama White House now claims that government "is completely immune from litigation for illegal spying—the Government can never be sued for surveillance that violates federal privacy statutes."

But, you can count on Obama and Congress to continue criticizing electronic surveillance abuses.  As long as they occur in other countries, that is. 

Copyright © 2010 by Mark Nestmann

Can Police Search Your Cell Phone without a Warrant?

Modern cell phones do a great deal more than simply send and receive calls.  They're sophisticated personal computers with the same capabilities, and more, of a laptop PC.  You can use them to send and receive e-mail and instant messages, browse the Internet, keep track of your appointments, take photos and videos, etc.

If you think that any of this information is "private" in the sense that it's legally protected, think again.  In most cases, it's not, especially if you're arrested.  If you're not under arrest, it's fairly clear that police have no right to search your cell phone without your consent.  At U.S. border crossings, though, customs authorities have carte blanche to copy all data on your cell phone, your laptop, etc.  (Click here for details.)

Nearly all state and federal courts that have considered this question have ruled that data on your cell phone has "no expectation of privacy."  Their decisions have derived mainly from two Supreme Court rulings decided many years before cell phones were invented.

Under the "search incident to arrest doctrine," the Supreme Court has held that police can search someone they are arresting.  Police may open any "containers" the person being arrested has in their pockets or otherwise is carrying.  This is true even if no probable cause exists that the containers contain anything illegal.  In cases involving cell phone searches, courts have held that by analogy, a cell phone is likewise a "container." Any information on your cell phone can be used against you in a subsequent criminal case.

The Supreme Court has also declared that you have no expectation of privacy in the telephone numbers you dial.  When you dial a telephone number, you must reveal that number to your telephone company.  Since you voluntarily convey that information, you assume the risk that it might be revealed to police.

One court, however, has ruled differently.  On December 15, 2009, the Ohio Supreme Court ruled that police must obtain a search warrant before scouring the contents of a suspect's cell phone, unless their safety is in danger.  The prosecutor in the case says the state may appeal the decision to the U.S. Supreme Court.

However, I suspect that even if the Supreme Court upholds this decision, you won't be able to count on legal protection for your cell phone data.  That's because of a legal doctrine called "exigent circumstances."  In the context of cell phone searches, in some cases, the data on a cell phone may be altered or deleted by an incoming call or simply by turning off the power.  So if the Supreme uphold the Ohio ruling, you can anticipate lots of "exigent searches" of cell phones.

How can you protect yourself?  First, you could try to get along without a cell phone or other portable electronic device.  If you need to carry a cell phone, activate the password feature.  In some cases, this may create a legal expectation of privacy that prevents a warrantless search.  It may also prevent someone who steals your cell phone from being able to use it or retrieve data from it.

Also, use only the features you really need.  In my case, that means I use my cell phone only to make and receive calls.  I rarely send or receive text messages and never use it to take photos, send e-mail, or browse the Internet.  And I delete all data regularly.

But even this may not be enough.  Just like a personal computer, data you delete on your cell phone can be recovered until it’s overwritten.  To protect yourself, periodically reformat your cell phone to make it impossible for anyone to retrieve "not quite deleted" data.  To learn more, click here.

Finally, consider cell phone encryption.  You can encrypt data on an I-Phone, although I've read that the way Apple has implemented this feature has major security weaknesses.  If you have a smart phone that uses the Windows Mobile operating system, you can protect the data on it using a new product from PGP: PGP Mobile. I haven't used this software, but I'd welcome feedback from anyone who has.

With cell phones becoming ever more sophisticated, the risk of your data being compromised will only increase in the future.  Protect yourself now, not later!

Copyright © 2010 by Mark Nestmann

Windows "Shadow Copy" Raises Security Risks

I've long criticized the lackadaisical attitude of Microsoft toward security.  However, in recent years they've done a much better job identifying and patching vulnerabilities in their operating systems and applications.

One exception, though, is the "Shadow Copy" feature incorporated into Windows Vista and Microsoft's newest operating system, Windows 7.  Shadow Copy is what lets these operating systems restore your system to an earlier configuration if disaster strikes (e.g., you accidentally delete a critical program, a botched upgrade crashes your PC, etc.)

The default configuration of both Vista and Windows 7 has Shadow Copy activated.  It automatically copies everything on your system volume (Drive C).  And I mean everything: not just your system files, but your program files, user settings, and whatever documents you've created.

That's convenient, but it's also a security risk.  You can never be 100% certain that a file you want to delete is actually gone.  Nor can you be certain that the original version of a file you encrypt is actually deleted, even if you use a program like PGP to securely delete it.  If Shadow Copy stored the original file, you can retrieve it by restoring your system to a previous version. 

That's potentially a big problem.  Windows XP doesn't present this security risk because it backs up only system files in its System Restore facility—not documents.  And unfortunately, you can't tweak Shadow Copy to back up only system files.  You have to turn it off to inactivate it.  But if you do that then you have no way to return your PC to an earlier state if disaster strikes.

I'm not a computer security expert, but it seems to me there would be a couple ways to protect yourself without inactivating Shadow Copy altogether. 

1. Use a program like Acronis Disk Director to set up additional disk partitions on your PC.  Put your data on one of the additional partitions.  Since Shadow Copy backs up only the data on the C drive, it won't back up your data.  Just make sure to encrypt sensitive files once you've finished working with them, and make regular backups.
2. Encrypt your entire hard disk.  That way, every file, copy, or cache Windows creates is encrypted.  The "BitLocker" system Microsoft includes with some versions of Vista Windows 7 is one approach, but I prefer PGP Whole Disk. This program works with all versions Vista and Windows 7 as well as earlier Windows operating systems.  I've used it for several years and have never encountered any problems beyond forgetting one of my passphrases for several hours.  Another option is TrueCrypt, a free program I've never used, but that several of my clients recommend highly. 

If you have other suggestions, please pass them along in the comments.

Copyright © 2010 by Mark Nestmann