Ashley Bell

A bank that inadvertently sent confidential account information on 1,325 of its customers to the wrong Gmail address is suing Google for the identity of the Gmail account holder. According to court documents, the bank in August received a request from one of its customers asking for certain loan statements to be sent to a third-party. The case, filed in the U.S. District Court for the Northern District of California, involves Rocky Mountain Bank of Wyoming. An employee of the bank, responding to the request, sent the documents to the wrong Gmail address.

When it discovered the error, the bank immediately sent an e-mail to the Gmail address asking the recipient to delete the previous email and the attachment. In addition to the requested loan information, the bank employee also inadvertently attached a file containing names, addresses, tax identification numbers and other details on 1,325 account holders to the same address. The bank also asked the recipient to contact the bank to discuss what actions had been taken to comply with the bank's request. When Google refused to provide any information on the account without a formal subpoena or court order, the bank filed a complaint asking the court to force Google to identify the account holder. When it received no reply, the bank sent an e-mail to Google asking whether the Gmail account was active or dormant and also what it could do to prevent unauthorized disclosure of the inadvertently leaked information.

Rocky Mountain Bank also requested that its complaint and all of the pleadings and filings in the case be sealed. U.S. District Court Judge Ronald Whyte dismissed that request, saying there was no need for the proceedings to be sealed. "An attempt by a bank to shield information about an unauthorized disclosure of confidential customer information until it can determine whether or not that information has been further disclosed and/or misused does not constitute a compelling reason," Whyte wrote last week. The bank said it hopd to prevent unnecessary panic among its customers and a "surge of inquiry from its customers." The bank argued that if the complaint and motion papers are not sealed, all of its customers would learn of the inadvertent disclosure. This is the third time in recent weeks that Google has faced a similar issue. The man alleged that the contributors to the paper had unfairly linked him to government corruption. Earlier this month, the Associated Press reported that a resort developer in Miami had obtained a court order requiring Google to disclose the identities of anonymous contributors to an online newspaper in the Turks and Caicos Islands.

In that case, Google indicated that it would disclose the data only after first informing the paper about the request and giving it a chance to appeal for the court order to be quashed. In the other incident, a court in New York compelled Google to disclose the identity of a blogger who had made disparaging comments about a Vogue model in her blog "Skanks in NYC."

Network companies struggled to obtain venture funding throughout 2009, and finished the year out with another dismal quarter, according to data released this week. For all of 2009, investors gave $5.1 billion to network companies, down from $9.4 billion the previous year and the lowest total since 1996. The total number of companies receiving funding last year was 1,003, the lowest since 1995. "We're down about half from where we were a year ago," says Tracy Lefteroff, a global managing partner of Pricewaterhouse Coopers, which produces the quarterly MoneyTree Report. "There are just no buyers for goods and services that are encouraging venture capitalists to put money in this space." http://www.networkworld.com/news/2009/121409-outlook-tech-mergers-acquis... ">Tech mergers and acquisitions to grow in 2010 If there's one positive stemming from the venture funding declines, it's that companies that do receive funding are likely to have a strong chance at long-term success. "The deals that are getting funded are high quality because the bar is so high in this space right now," Lefteroff says. In Q4 2009, venture funding for network vendors was $1.4 billion, down from $1.9 billion in the previous year's quarter. The youngest network vendors are having the most trouble securing funding, as start-up and seed companies only received $38 million in Q4 2009, less than half the total in the third quarter.

Notable deals that might interest IT professionals include $35 million for Aquantia, a maker of 10GBASE-T Ethernet products; $35 million for Palantir, a maker of data analysis software; $22.3 million for Widevine, a provider of encryption and key management systems; and $21 million for SandForce, a flash memory vendor. The biggest network deal of the fourth quarter went to Cheg, a textbook rental e-commerce site in Silicon Valley that received $57 million from venture firms. In the MoneyTree Report, network companies include makers of computer software, hardware, peripherals and services; data, Internet, satellite and wireless communications; Internet software, e-commerce, digital imaging, computer graphics and other network-related technologies. It's a five-year timeline that were dealing with, I think." Follow Jon Brodkin on Twitter: www.twitter.com/jbrodkin On the whole, investors have been wary of network companies for well over a year and there is little indication that trend might turn around in 2010, Lefteroff says. "I think it's going to be a long, painful recovery," Lefteroff says. "I don't see anything that would suggest that in the next year we're going to see a recovery.

ARLINGTON, Va. - Google's revelation last month that attacks out of China resulted in the theft of some of its data drew attention to the broader question at the Black Hat conference here over what can be done to the villains. The number of people who are arrested and convicted for any of the phishing attacks, intrusions and thefts is tiny. Cyberattacks give rise to anger and a very human desire to strike back, but pursuing attackers in ways that matter isn't accomplishing much.

Several countries, Russia and China in particular, don't want to cooperate on cybersecurity enforcement, said Andrew Fried, a security researcher at the Internet Systems Consortium, a nonprofit group, and a former special agent at the U.S. Treasury Department. "The reality is they don't want to do squat to help anybody," he said, on a panel at the cybersecurity conference today. But Jeff Moss, the founder of Black Hat and director of the conference, questioned whether too much emphasis is placed on that effort. After an attack, such as the China- Google incident, there's always interest in establishing "attribution" - identifying the source of the attack. Moss also serves on the Department of Homeland Security's security advisory council. "We should be spending more energy on dealing with the containment of an attack, reducing the effects of an attack," Moss said. "I don't think we will ever be able to stop the attack." Techies can argue over the source of the Google attack, Moss said, but "is China ever going to extradite anybody? No. So we should probably have a mechanism, a strategy in place, for mitigating, minimizing these attacks." Last month, Google said it was considering pulling out of China after revealing the attacks.

No," he said. "Are we going to go to war over it? Secretary of State Hillary Clinton, in a recent speech on Internet freedom , offered an impassioned defense for the "freedom to connect." But Moss questioned whether Clinton was proposing a U.S. policy for the Internet akin to the "freedom of seas model." "The U.S. Navy spent a lot of time beating up pirates," Moss said. "Is that a call for us to go police the cyber seas ... or does it mean something else, because I don't think that we've got the capability [to defend] the world's cyberspace and keep it free." Google's battle with China in some ways is little more than sideshow compared with what some companies are dealing with. Ben Butler, director of network abuse at GoDaddy, said his department's 19-member staff conducted 232,000 investigations last year over a range of abuses, including spam, phishing and copyright enforcement. Take GoDaddy, for instance, the world's largest domain registrar with more than 38 million domain names. For its trouble, GoDaddy is sued 30 to 40 times a day over the actions it takes, such as suspending a domain, but despite those attempts, "nobody has been successful in suing us yet," said Butler, who was also on a panel. Although most spam is caught in traps, there's enough that gets by to prompt Richard Cox, the CIO of The Spamhaus Project Ltd., a U.K. nonprofit group that tracks spam senders and services, to offer what may be a novel theory as to one of the enablers of the housing bubble.

Among the multitude of security issues, spam is high on the list. He claimed that spam contributed significantly in the selling of subprime mortgages. Air travelers may be screened and searched for explosives, but foreign entities can easily establish a server foothold with co-location providers. "You wouldn't let it happen at the airport, so why would you let the ISPs do it? But Cox was particularly harsh on the U.S. efforts to address security issues. That's effectively what you are doing," he said on a conference panel. His company's research has found that the lapse between initial breach and detection in an organization's security systems is about 156 days. "Attackers basically know that they have unlimited amounts of time once they get into an environment," he said.

In another panel, Nicholas Percoco, senior vice president of SpiderLabs at Trustwave, highlighted the need for more focus on protection. The conference keynote speaker, Gregory Schaffer, DHS assistant secretary of the Office of Cybersecurity and Communications, was asked by one attendee about the U.S. responsibility to defend against attacks launched in other countries. "I think the DHS role, at this point, is to defend the federal civilian executive branch networks," Schaffer said. "We have a leadership role in assisting with the .com space," he said, referring to the commercial sector. Patrick Thibodeau covers SaaS and enterprise applications, outsourcing, government IT policies, data centers and IT workforce issues for Computerworld . Follow Patrick on Twitter at @DCgov , send e-mail to pthibodeau@computerworld.com or subscribe to Patrick's RSS feed . Read more about security in Computerworld's Security Knowledge Center.

Microsoft's new free Security Essentials looks like it can get the job done, according to new scanning tests conducted by AV-Test.org. In a post on the day of its launch, I referenced AV-Test performance results from a MSE beta. The free standalone antivirus product has caused a stir since its Tuesday release, as might be expected when the words "Microsoft" and "free" are involved. We now have new results from tests conducted this week against the final product (available for download), and overall MSE looks good: Malware detection: MSE detected 98.44 percent of AV-Tests's collected zoo of 545,034 viruses, worms, backdoors, bots and Trojans, an entirely respectable showing.

As expected, MSE detected 100 percent of the samples in the Wildlist. However, it didn't do nearly as well when it came to detecting adware and spyware, such as bank info stealers, and detected only 90.95 percent of the 14,222 samples. Most reputable AV apps detect all the Wildlist samples. AV-Test found that MSE doesn't include any effective behavioral detection. Dynamic/behavioral detection: If a program includes behavioral detection, it can identify malware based solely on how it acts on a PC. It's a useful feature for detecting brand-new malware that doesn't yet have a signature. However, AV-Test's Andreas Marx noted that's typically the case for standalone antivirus programs, and that you'll generally need to buy a security suite to get the feature.

Disinfection: MSE was able to clean up all of the active components from 25 different test infections, meaning the malware was effectively neutered. Or, you can pair your free or paid standalone AV program with PC Tools' free Threatfire, which adds an impressive layer of behavioral detection to your security arsenal. As is usually the case, the program often left behind some traces of the infection, such as registry entries or a turned-off Windows firewall. It identified and removed all 25 rootkits (stealth technology used to hide other malware) used in the tests. Rootkit removal: MSE did well here.

Scan speed: When I compared the MSE beta to other free (and finished) AV apps over the summer, it came in last for scanning speed. False alarms: Security Essentials didn't put up any false positives for any of 600,000 known clean files used by Windows, Office and other common apps. In these latest tests, Marx says that MSE scan speed "is quite OK when compared with other AV products" - not the fastest, but not the slowest. However, as Marx notes, most of those files come from Microsoft, so a false positive would have been surprising. As with most other options in that category, it doesn't provide a firewall, behavioral detection, or other security extras. Overall, these results show that Security Essentials holds its own as a free standalone antivirus app.

But since Vista and Windows 7 already include a two-way firewall, and you can add top-notch behavioral protection with another free app, MSE looks like a good budget choice for baseline antivirus protection. Finally, if you're interested in a good business-side opinion piece on Microsoft's move, take a look at this post from Sunbelt's Alex Eckelberry.