Difference between School and Life

4 moves to make you confident of your retirement

March 19, 2012 8:06 AM

By Steve Vernon

 (iStockphoto mammamaart)

(MoneyWatch) The Employee Benefit Research Institute (EBRI) recently released its 2012 Retirement Confidence Survey, and the results are quite depressing.

-- Just 14 percent of survey respondents are very confident they'll have enough money to live comfortably in retirement. These results are the same as what was reported in 2009 and 2011.

-- Almost half of all survey respondents -- 42 percent -- cite job uncertainty as the most pressing financial issue facing most Americans. Only about one-fourth, or 28 percent, are very confident they'll have paid employment as long as they need it.

-- Many workers report they have virtually no savings; 60 percent say that the total value of their household savings is less than $25,000, excluding the value of their home and any pension benefits they expect to receive.

-- Almost two-thirds of respondents (62 percent) consider their current level of debt to be a problem.

-- Only 16 percent of those surveyed are very confident that their investments will grow in value.

Is there any good news about retirement out there? Being an optimist, my natural inclination is to dig deeper into the report to find some helpful insights, and I was successful in finding suggestions that can help increase your retirement confidence. These four suggestions might be difficult to implement, but nevertheless, they point to the tough steps people need to take to boost their retirement confidence.

1. Pay down your debt.

The percentage of employed people who reported that their level of debt is not a problem and that they have confidence in their ability to retire is more than five times higher than the percentage of workers who report that debt is a problem. Paying down your debt now -- before you retire and most likely will have less money coming in -- is one of the smartest steps you can take to create a stress-free retirement.

2. Calculate how much money you need to save to enjoy the retirement you want.

Only 42 percent of all workers report that they've tried to calculate how much money they need to save in order to retire comfortably. An equal number of employed people report that they've simply guessed at how much money they'll need to accumulate; in many cases, these people have guessed much too low. The people who report that they've made a mathematical calculation have more realistic savings goals and have a higher confidence in their ability to retire.

Don't have time to calculate how much money you need to save for retirement? One survey shows that Americans watch TV 28 hours per week on average. If you're one of these average Americans, I'd like to suggest that you eliminate one or two of your least favorite TV shows and use the available time to plan for your retirement.

3. Start saving more for retirement.

Survey respondents who report that they are saving money for retirement have far higher levels of retirement savings than workers who don't save for retirement. Well, duh! So join the savers and start accumulating the money you're going to need when you're retired.

4. Take care of your health.

Workers who report they're in good health have higher savings levels than workers reporting poor health. This makes sense: If you're in poor health, you're less likely to earn a good living and will be spending more money on medical bills, which mean you have less to put aside for the future.

Do these four suggestions I've made sound familiar to you? I know that a natural reaction is to think that these steps might be difficult to adopt, but they're really well within anybody's ability, provided you can find the necessary motivation. I know many people who are paying attention to their spending, saving more, eating better and exercising more, and their retirement will be the better for it.

It's in your power to boost your retirement confidence. What are you waiting for?

Photo courtesy of iStockphoto contributor mammamaart.

 
Steve Vernon
For more than 30 years, consulting actuary Steve Vernon helped large employers design and manage their retirement programs. Now he helps you meet the new retirement goals: Have enough money to be happy for a long, healthy life. Survive economic meltdowns. Avoid being broke at age 85. Live your life, not the life defined by others.

http://www.cbsnews.com/8301-505146_162-57399581/4-moves-to-make-you-confident-of-your-retirement/?tag=nl.e713

8 ways to focus when working from home

March 19, 2012 11:28 AM

By Amy Levin-Epstein

 (Photo courtesy of Wikimedia user Carlosar.)

(MoneyWatch) Working at a home office is a blessing and a curse. Your commute is nil, but distractions are everywhere. Television, household chores, dogs, children, roommates and spouses can all knock you off your game. I asked dozens of those in the trenches to share their best work-from-home tips. Here are eight of the most helpful:

Work in the still of the night
"I started working from home in October last year after the birth of my second baby prompted me to start my own business. With two small children at home with me most days, it can get tricky. Many people will say to work when children are sleeping, but I [say] to work when everyone is sleeping. I have on many occasions fired up the laptop at 2 a.m. after waking up in the night." -- Cassy Small, founder of Big Fish Planning

Silence your space (however works for you)
"As silly as this sounds, one thing that works for me is using the bathroom fan. I will go upstairs in my bedroom to do work and put on the bathroom fan. This louder, consistent humming noise is continually running in the background. When it is on, I cannot hear the phone, the door or outside distractions like cars or people talking." -- Len Saunders, author of "Keeping Kids Fit"

Dress the part of an office worker
"Regardless of whether you are working from home or not, dress as if you are going to meet with clients. This will provide you with a better professional presence [even] over the phone. And do you really want to do dishes in that nice shirt/blouse?" -- Mark Frietch, president, TAC Services

Respect your internal clock
"I'm more productive if I actually allow myself to work on my natural sleep cycle. I'm naturally a night owl, but for a long time I tried to keep regular business hours. It's an admirable thing to try to do, but I was groggy and unproductive in the morning. I finally decided to let myself work in the afternoons, evenings and sometimes well into the early morning hours. I'm able to hone in, focus and get things done. Not only am I more productive, I'm a lot happier, too!" -- Laura Williams, freelance writer and CEO of GirlsGoneSporty

Keep track of time
"I am a slave to my to do list. I make a commitment to myself, based on the amount of time that I have available before a meeting or a break, of how many items I will cross off my to do list. I then stay at my desk until that many items are crossed off. For big tasks, I set a timer for 20 minutes at a time and work like crazy for that 20 minutes before taking a short break." -- Laura Barta, founder of Whole Wide World Toys

Keep your personal life out
"For a long time, I had friends and family that assumed since I worked from home that I could simply do whatever I wanted when I wanted. Eventually I got so irritated at my boyfriend stopping by that I had to lay down a rule: if the door was shut and it was quiet inside, it meant I was basically at any kind of office and couldn't be bothered. Part of focus has so much to do with letting others know what the boundaries are." -- Desireee Baughman, blogger with Consumer Media Network and writer for InsuranceQuotes.org

Take breaks
"Don't feel guilty about leaving the house. I try to leave the house for at least two hours each day. Some days that means going to the gym. Other days it means taking my computer to Starbucks, going for a walk, or just going to the grocery store. Make weekend plans. When I went to the office everyday, my favorite way to spend my weekends was relaxing at home. Now that I work at home, I find that it's helpful to spend more time out of the house. When Monday comes around, I feel much more refreshed, focused and ready to take on the week." -- Kevin Spence, founder of Career Thoughts

Unplug yourself
"There's a reason large companies limit Internet access and websites -- because they're major time wasters. One of the best things you can do is block out a specific amount of time and unplug everything that doesn't have to do with what your task is at that very moment. Turning off your cellphone and shutting off your wireless router will eliminate the overwhelming draw that you feel to do anything but work. After you check your morning email and various other things, unplug at 9:30 a.m. and commit to not plugging back in until 12 p.m. See how much you'll get done in 2 1/2 hours of a web-less world, or, as some people call it, every day of work in the history of mankind until about 15 years ago." -- Jon Finkel, author of "The Three Dollar Scholar"

What are your best work-from-home tips?

Photo courtesy of Wikimedia user Carlosar.

Amy Levin-Epstein

Amy Levin-Epstein is a freelance writer who has been published in dozens of magazines (including Glamour, Self and Redbook), websites (including AOLHealth.com, Babble.com and Details.com) and newspapers (including The New York Post and the Boston Globe). To read more of her writing, visit AmyLevinEpstein.com. Follow her on Twitter at @MWOnTheJob.

http://www.cbsnews.com/8301-505125_162-57399895/8-ways-to-focus-when-working-from-home/?tag=nl.e713

Facebook: 5 people never to friend from work

January 9, 2012 1:05 PM

By Amy Levin-Epstein

 (Toby Talbot)

How many co-workers are you connected to on Facebook? A new survey by Millennial Branding found that the average Gen Y employee is connected to 16 office-mates on the popular social networking site. The interesting part? Only 36 percent officially listed their place of employment, while 80 percent noted where they had gone to school. So while this group appears to be trying to keep their personal and professional worlds separate, they're still merging them by connecting to colleagues.

There are a slew of ways that Facebook can get you fired, and connecting to the wrong people in your office is one of the easiest ones. Here are five people you should never friend:

Your boss

Friending your boss on Facebook might seem like a good way to get close to your manager, but in this case it may be too close for comfort. "If you friend your boss on Facebook, and then complain about them or share something too personal, they might lose trust in you, not take you seriously and potentially replace you," notes branding expert Dan Schawbel, CEO of Millennial Branding.

Your HR rep

Friending your human resources representative comes with many of the same issues as friending your boss. "If you friend your HR representative on Facebook, and then reveal a company secret or criticize your boss, then they will have more than enough reason to report you to your manager," says Schawbel.

Your office "frenemy"

If you have a less-than-friendly office competitor, don't take the "keep your friends close and enemies closer" approach via Facebook. "Schadenfreude, envy, competitive juices and just plain score-keeping is a terrific reason for keeping frenemies out of your life and your FB commentary," says Ellen Lubin-Sherman, author of The Essentials of Fabulous: Because Whatever Doesn't Work Here Anymore. Someone who doesn't have your best interests at heart face-to-face will jump at any opportunity to find a skeleton online and bring it out of your closet.

A previous boss

If you leave a company on great terms with your boss, by all means, stay in touch -- on Linkedin, suggests David Couper, career coach and author of Outsider On The Inside: How To Create A Winning Career...Even When You Don't Fit In!. If you want to reconnect for professional reasons (for a reference or new job, for example) you'll be glad you kept the two zones of your life -- professional and personal -- absolutely separated.

Anyone you manage

You maintain a certain image in the office, and it's almost impossible to perfectly maintain that same image online, even with strict settings. "Again, you may disclose information that could be damaging. For example, if you show a picture of you enjoying the sights on a 'business trip' you may lose credibility with your team," says Couper.

  Amy Levin-Epstein

Amy Levin-Epstein is a freelance writer who has been published in dozens of magazines (including Glamour, Self and Redbook), websites (including AOLHealth.com, Babble.com and Details.com) and newspapers (including The New York Post and the Boston Globe). To read more of her writing, visit AmyLevinEpstein.com. Follow her on Twitter at @MWOnTheJob.

http://www.cbsnews.com/8301-505125_162-57355185/facebook-5-people-never-to-friend-from-work/?tag=mncol;lst;1

Business Networking Without Looking Desperate: 5 Rules

April 26, 2010 3:00 AM

By Amy Levin-Epstein

Trying to squeeze business opportunity out of this economy is an arduous task at best. And as job numbers remain shakier than the Pacific Rim, the term "it's who you know" is more relevant than ever for career development.

"Networking is something you should continually be doing," says Ronn Torossian, CEO of the New York City-based 5W Public Relations firm. "It's kind of like dating. Until you're married, you always have to be dating. And when you're married, you're working on your relationship."

That means networking can't be something you put on a to-do list and check off once a month, and it needn't be scheduled. "I was sitting next to this woman while having a pedicure and we started talking," recalls Ross Ellis, CEO of Love Our Children USA, a national nonprofit working to break the cycle of violence against children and a New York City real estate agent with Halstead Property. One thing led to another, and soon Ellis had a speaking engagement for her charity: "She was a teacher and I asked her if she had a lot of bullying in her school."

Sounds simple, but rub new contacts the wrong way and your network will shrink, not expand. Here's how to become an expert networker, without ever being annoying, or worse, looking desperate:

1. Nurture Your Network ... Patiently

The key to good networking is distinguishing it from, say, asking for a job, a contact, or Hannah Montana tickets for your daughter. "Networking by definition means talking to people when you don't need something," says Peter Shankman, founder of HARO, a resource that connects small businesses with journalists. "Some people walk into a party, throw 50 business cards around and then leave. I call them business-card ninjas."

Keeping in touch is crucial, he adds — so that when you need someone, a follow-up isn't like an initial meeting. "I got this random e-mail six months after I met someone, saying 'Hey, I'm looking for a job,'" says Shankman of one tactless attempt at networking. His response: "I'm only hearing from you when you need something?"

You should also keep your online profile active; you never know who's watching. While freelancing in media relations, Sarah Bottoms started posting successful media placements for clients on her LinkedIn page, which was viewed by her network of 400 people — including a former colleague. "She eventually referred me for a full-time position at Vidicom, a broadcast PR firm where I now work as a media relations specialist," says Bottoms.

2. Ask How You Can Help

How can you avoid looking impatient? To paraphrase JFK: Ask first not what your contact can do for you, but what you can do for your contact. Not only is it polite to ask about the other person, but asking about them will send the signal that you have a peer-peer relationship, not a mentor-student one. Better yet, help that person — it's good karma, and they will want to return the favor. "Networking is about finding a win-win situation for all the parties involved in the connection," says Ellen Whitehurst, a Virginia Beach writer and feng shui expert. "Anything else is usually called a favor."

Plus, focusing on the other person may help you get into a more substantive conversation. Not quite sure how to start? "Everyone you meet, you should make it a goal to let them talk. Find out what they do, what they need, long before you start talking or touting yourself," Shankman suggests.

3. Know When to Ask — and How

You needn't be afraid to ask for help after you've done your due diligence. But be conscious of your message: If you're looking for job contacts, for instance, what should come across is that you're available for great opportunities — not that you're a laid-off loser. "It's all in your delivery. The worst is not having a positive attitude," says Rita Allen, a Massachusetts-based executive coach.

You wouldn't go into an interview and speak negatively about your industry, right? So don't do it on Facebook or in a mass e-mail. Instead, be specific about your goals and create a personal brand, particularly if you're reaching out to many people at once. "If you're not prepared and confident in your message, that's when you come across as desperate," says Allen.

4. Make the Web Work for You

This one should be obvious: The Web is the fastest-expanding arena for networking, with LinkedIn and Twitter leading the way. "I use LinkedIn to stay connected with my business contacts so I don't lose contact information when someone switches jobs," says motivational speaker and strategy consultant John Paul Engel, who used networking to publish his book, Project Be The Change, and get it distributed to students throughout the country. Now, Engel uses Facebook as a free publicist. "I've promoted the book on Facebook through postings about my speeches and other project-related activities," he adds.

Some people are even parlaying their 140 characters into full-time jobs. After being laid off from her position as a news reporter at a Wisconsin TV station, Jenna Bennett fired up her Twitter account. "I wanted to make the switch from news into public relations, so I started following agencies and individuals at those agencies," says Bennett. "I started following my current boss [at LaBreche, a Minneapolis communications agency] and our HR manager, Andrea. Andrea and I exchanged messages, and I asked if I could visit LaBreche for an informational interview. Although they didn't have an opening at that time, I stayed in touch with Andrea on Twitter and when they did have an opening in February, she sent me a private message on Twitter and told me about it."

Play CBS News Video

5. Shake Some Hands

As crucial as it is to have an online presence, connecting in person can leave a more lasting impression — whether you set up an informational interview, as Bennett did, or just meet for a coffee. When Dr. Doug Hirschorn, a Wall Street performance coach and author of 8 Ways To Great, was trying to sell his first book in 2001, he cold-called publisher John Wylie, and was asked to send his book in — but he didn't. "I asked if I could come in in person. I walked out with a contract," says Hirschorn, who now regularly appears on CNBC.

Not only is direct eye contact a better way to make a connection; sometimes it is the only way. "I don't think high-level executives are interacting on Facebook," says Torossian, who adds that he personally doesn't put much personal information on Facebook, and that his assistant checks his page. It's a lot easier to get to a CEO of a company if you happen to literally bump into them at a bar than if you have to push through 12 levels of virtual protection.

So before you check your coat at your next networking event, prepare your message, goals and research your audience. "You should go into any networking potential or opportunity with at least an idea of who you'd like to meet and why. Even if you are networking for PTA purposes, you should know who the last two presidents of the local chapter or of your school (or both) are, and should know something about the new president and their relationship with your home school, and how you can help," says Whitehurst.

By being specific with your goals, using technology properly and following the golden rule of giving before taking, you'll attract a strong network of peers — a priceless commodity in any economy.

• Amy Levin-Epstein
  Amy Levin-Epstein is a freelance writer who has been published in dozens of magazines (including Glamour, Self and Redbook), websites (including AOLHealth.com, Babble.com and Details.com) and newspapers (including The New York Post and the Boston Globe). To read more of her writing, visit AmyLevinEpstein.com. Follow her on Twitter at @MWOnTheJob.

http://www.cbsnews.com/8301-505125_162-51417354/business-networking-without-looking-desperate-5-rules/?tag=mncol;lst;6

Boot these people from your professional network

March 15, 2012 1:35 PM

By Amy Levin-Epstein

 (Dru Bloomfield via Wikimedia Commons)

(MoneyWatch) Networking is a crucial part of building your career and, generally, the bigger your network, the better. Like spiderwebs, larger networks tend to catch more opportunities for you. Sometimes, though, bad seeds in your network can act like black widows, having the opposite effect.

I spoke with networking expert Dan Schawbel, who founded Millennial Branding, a Gen-Y research and management consulting firm. He said there are three types of people you should scan your network for. If you spot one, eliminate them -- not only won't they help you, they can hurt you. They include:

The user. Networking is about give and take, and "users" only take. "They will ask you for favors, hound you for advice, and beg you to introduce them to other members of your network. When you ask for something, they will make an excuse such as, 'I'm really not sure how to handle that,' or 'I don't know them well enough to make an introduction,' " Schawbel says. Dump a user out of your network by giving them a taste of their own medicine -- say you're too busy or don't have the right contact. Eventually, they'll see they can't get anything from you and will leave you alone.

The backstabber. The saying "keep your friends close and your enemies closer" doesn't really apply in networking. But your "enemies" might not always be obviously apparent. "A backstabber might compete with you or have friends that do," Schawbel says. "They could be jealous of you and want you to fail. They openly tell you how great you are and what they want to do for you, when really they desire to lead you in the wrong direction and take as much as they can from you."

Of course, some selfless people just want to help even if you are a competitor. Schawbel suggests not only using your best judgement, but also listening to what others in your network say about a potential backstabber.

The sketchball. Truly unreliable people have no place in your professional network (nor, some would argue, in your personal one). After all, your network is a branding tool, and those with a place in it may reflect both well and poorly on you. Even in a creative industry, people whose reputation is tarnished by truly erratic or distasteful behavior are best to avoid.

"These people [may] have drug-related problems that they aren't open about that affect them emotionally. If you get too close to them, they will start relying on you and take you down with them," Schawbel says.

Who have you had to eliminate from your network?

Photo courtesy of Dru Bloomfield via Wikimedia Commons

  Amy Levin-Epstein

Amy Levin-Epstein is a freelance writer who has been published in dozens of magazines (including Glamour, Self and Redbook), websites (including AOLHealth.com, Babble.com and Details.com) and newspapers (including The New York Post and the Boston Globe). To read more of her writing, visit AmyLevinEpstein.com. Follow her on Twitter at @MWOnTheJob.

http://www.cbsnews.com/8301-505125_162-57398063/boot-these-people-from-your-professional-network/?tag=nl.e713

TelecomTV | Video | Executive Insight: WiFi no longer a dirty word

TelecomTV | Video | Executive Insight: WiFi no longer a dirty word

*If you received this via email, click on the link at "Posted by ECGMA to ECGeneral Blog" to view the blogpost"*

Licensing Issues

Anything that is not public domain has a copyright, possibly more than one. Under U.S. federal law, the authors of a work hold copyright even if there is no copyright notice.

Who counts as an author under copyright law can be complicated, especially for software that has been worked on by many hands. This is why licenses are important. They can authorize uses of code in ways that would be otherwise impermissible under copyright law and, drafted appropriately, can protect users from arbitrary actions by the copyright holders.

In the proprietary software world, the license terms are designed to protect the copyright. They're a way of granting a few rights to users while reserving as much legal territory as possible for the owner (the copyright holder). The copyright holder is very important, and the license logic so restrictive that the exact technicalities of the license terms are usually unimportant.

As will be seen below, the copyright holder typically uses the copyright to protect the license, which makes the code freely available under terms he intends to perpetuate indefinitely. Otherwise, only a few rights are reserved and most choices pass to the user. In particular, the copyright holder cannot change the terms on a copy you already have. Therefore, in open-source software the copyright holder is almost irrelevant — but the license terms are very important.

Normally the copyright holder of a project is the current project leader or sponsoring organization. Transfer of the project to a new leader is often signaled by changing the copyright holder. However, this is not a hard and fast rule; many open-source projects have multiple copyright holders, and there is no instance on record of this leading to legal problems. Some projects choose to assign copyright to the Free Software Foundation, on the theory that it has an interest in defending open source and lawyers available to do it.

What Qualifies as Open Source

For licensing purposes, we can distinguish several different kinds of rights that a license may convey. There are rights to copy and redistribute, rights to use, rights to modify for personal use, and rights to redistribute modified copies. A license may restrict or attach conditions to any of these rights.

The Open Source Definition is the result of a great deal of thought about what makes software "open source" or (in older terminology) "free". It is widely accepted in the open-source community as an articulation of the social contract among open-source developers. Its constraints on licensing impose the following requirements:

An unlimited right to copy be granted.

An unlimited right to redistribute in unmodified form be granted.

An unlimited right to modify for personal use be granted.

The guidelines prohibit restrictions on redistribution of modified binaries; this meets the needs of software distributors, who need to be able to ship working code without encumbrance. It allows authors to require that modified sources be redistributed as pristine sources plus patches, thus establishing the author's intentions and an "audit trail" of any changes by others.

The OSD is the legal definition of the "OSI Certified Open Source" certification mark, and as good a definition of "free software" as anyone has ever come up with. All of the standard licenses (MIT, BSD, Artistic, GPL/LGPL, and MPL) meet it (though some, like GPL, have other restrictions which you should understand before choosing it).

Note that licenses that allow only noncommercial use do not qualify as open-source licenses, even if they are based on GPL or some other standard license. Such licenses discriminate against particular occupations, persons, and groups, a practice which the OSD's Clause 5 explicitly forbids.

Clause 5 was written after years of painful experience. No-commercial-use licenses turn out to have the problem that there is no bright-line legal test for what sort of redistribution qualifies as 'commercial'. Selling the software as a product qualifies, certainly. But what if it were distributed at a nominal price of zero in conjunction with other software or data, and a price is charged for the whole collection? Would it make a difference whether the software were essential to the function of the whole collection?

Nobody knows. The very fact that no-commercial-use licenses create uncertainty about a redistributor's legal exposure is a serious strike against them. One of the objectives of the OSD is to ensure that people in the distribution chain of OSD-conforming software do not need to consult with intellectual-property lawyers to know what their rights are. OSD forbids complicated restrictions against persons, groups, and occupations partly so that people dealing with collections of software will not face a combinatorial explosion of slightly differing (and perhaps conflicting) restrictions on what they can do with it.

This concern is not hypothetical, either. One important part of the open-source distribution chain is CD-ROM distributors who aggregate it in useful collections ranging from simple anthology CDs up to bootable operating systems. Restrictions that would make life prohibitively complicated for CD-ROM distributors, or others trying to spread open-source software commercially, have to be forbidden.

On the other hand, the OSD has nothing to say about the laws of your jurisdiction. Some countries have laws against exporting certain restricted technologies to named 'rogue states'. The OSD cannot negate those, it only says that licensors may not add restrictions of their own.

Standard Open-Source Licenses

Here are the standard open-source license terms you are likely to encounter. The abbreviations listed here are in general use.

MIT
MIT X Consortium license (like BSD's but with no advertising requirement)

BSD
University of California at Berkeley Regents copyright (used on BSD code)

Artistic License
Same terms as Perl Artistic License

GPL
GNU General Public License

LGPL
Library (or 'Lesser') GPL

MPL
Mozilla Public License

We'll discuss these licenses in more detail, from a developer's point of view, in Chapter 19. For the purposes of this chapter, the only important distinction among them is whether they are infectious or not. A license is infectious if it requires that any derivative work of the licensed software also be placed under its terms.

Under these licenses, the only kind of open-source use you should really worry about is actual incorporation of the free-software code into a proprietary product (as opposed, say, to merely using open-source development tools to make your product). If you're prepared to include proper license acknowledgements and pointers to the source code you're using in your product documentation, even direct incorporation should be safe provided the license is not infectious.

The GPL is both the most widely used and the most controversial infectious license. And it is clause 2(b), requiring that any derivative work of a GPLed program itself be GPLed, that causes the controversy. (Clause 3(b) requiring licensors to make source available on physical media on demand used to cause some, but the Internet explosion has made publishing source code archives as required by 3(a) so cheap that nobody worries about the source-publication requirement any more.)

Nobody is quite certain what the "contains or is derived from" in clause 2(b) means, nor what kinds of use are protected by the "mere aggregation" language a few paragraphs later. Contentious issues include library linking and inclusion of GPL-licensed header files. Part of the problem is that the U.S. copyright statutes do not define what derivation is; it has been left to the courts to hammer out definitions in case law, and computer software is an area in which this process (as of mid-2003) has barely begun.

At one end, the "mere aggregation" certainly makes it safe to ship GPLed software on the same media with your proprietary code, provided they do not link to or call each other. They may even be tools operating on the same file formats or on-disk structures; that situation, under copyright law, would not make one a derivative of the other.

At the other end, splicing GPLed code into your proprietary code, or linking GPLed object code to yours, certainly does make your code a derivative work and requires it to be GPLed.

It is generally believed that one program may execute a second program as a subprocess without either program becoming thereby a derivative work of the other.

The case that causes dispute is dynamic linking of shared libraries. The Free Software Foundation's position is that if a program calls another program as a shared library, then that program is a derivative work of the library. Some programmers think this claim is overreaching. There are technical, legal, and political arguments on both sides that we won't rehash here. Since the Free Software Foundation wrote and owns the license, it would be prudent to behave as if the FSF's position is correct until a court rules otherwise.

Some people think the 2(b) language is deliberately designed to infect every part of any commercial program that uses even a snippet of GPLed code; such people refer to it as the GPV, or "General Public Virus". Others think the "mere aggregation" language covers everything short of mixing GPL and non-GPL code in the same compilation or linkage unit.

This uncertainty has caused enough agitation in the open-source community that the FSF had to develop the special, slightly more relaxed "Library GPL" (which they have since renamed the "Lesser GPL") to reassure people they could continue to use runtime libraries that came with the FSF's GNU compiler collection.

You'll have to choose your own interpretation of clause 2(b); most lawyers will not understand the technical issues involved, and there is no case law. As a matter of empirical fact, the FSF has never (from its founding in 1984 to mid-2003, at least) sued anyone under the GPL but it has enforced the GPL by threatening lawsuit, in all known cases successfully. And, as another empirical fact, Netscape includes the source and object of a GPLed program with the commercial distribution of its Netscape Navigator browser.

The MPL and LGPL are infectious in a more limited way than GPL. They explicitly allow linking with proprietary code without turning that code into a derivative work, provided all traffic between the GPLed and non-GPLed code goes through a library API or other well-defined interface.

When You Need a Lawyer

This section is directed to commercial developers considering incorporating software that falls under one of these standard licenses into closed-source products.

Having gone through all this legal verbiage, the expected thing for us to do at this point is to utter a somber disclaimer to the effect that we are not lawyers, and that if you have any doubts about the legality of something you want to do with open-source software, you should immediately consult a lawyer.

With all due respect to the legal profession, this would be fearful nonsense. The language of these licenses is as clear as legalese gets — they were written to be clear — and should not be at all hard to understand if you read it carefully. The lawyers and courts are actually more confused than you are. The law of software rights is murky, and case law on open-source licenses is (as of mid-2003) nonexistent; no one has ever been sued under them.

This means a lawyer is unlikely to have a significantly better insight than a careful lay reader. But lawyers are professionally paranoid about anything they don't understand. So if you ask one, he is rather likely to tell you that you shouldn't go anywhere near open-source software, despite the fact that he probably doesn't understand the technical aspects or the author's intentions anywhere near as well as you do.

Finally, the people who put their work under open-source licenses are generally not mega-corporations attended by schools of lawyers looking for blood in the water; they're individuals or volunteer groups who mainly want to give their software away. The few exceptions (that is, large companies both issuing under open-source licenses and with money to hire lawyers) have a stake in open source and don't want to antagonize the developer community that produces it by stirring up legal trouble. Therefore, your odds of getting hauled into court on an innocent technical violation are probably lower than your chances of being struck by lightning in the next week.

This isn't to say you should treat these licenses as jokes. That would be disrespectful of the creativity and sweat that went into the software, and you wouldn't enjoy being the first litigation target of an enraged author no matter how the lawsuit came out. But in the absence of definitive case law, a visible good-faith effort to meet the author's intentions is 99% of what you can do; the additional 1% of protection you might (or might not) get by consulting a lawyer is unlikely to make a difference.

http://www.faqs.org/docs/artu/ch16s07.html

By Channel NewsAsia, Updated: 12/03/2012

Customers report unauthorised charges on iTunes

Customers report unauthorised charges on iTunes

• You recommend this33%You don't recommend this67%
• Shared 7 times
• 
  

Screen grab of Apple's iTunes website.

SINGAPORE: Credit card customers in Singapore have reported suspicious transactions charged to them through iTunes, an online Apple application store.

Their fear is that someone had hacked into their iTunes account, or that their credit card information had been compromised.

Some of these transactions can be traced to places such as China and Luxembourg.

At least six customers told Channel NewsAsia that they've been affected.

One reported unauthorised transactions of up to S$7,000.

Customers of several banks, including DBS, UOB, Standard Chartered and Citibank, reported similar experiences.

One of those affected is Ms Ong, who said she had not used her iTunes account for two years. Her credit card bill dated February showed that she had spent S$266 for two transactions.

"When I called the credit card company and asked whether there are similar case ongoing, they couldn't quite give me an answer. They actually mentioned that they can terminate my card and issue me a new card. At the same time, they can conduct an investigation but it will take 60 days. So, in the meantime I don't really need to make payment for these two unauthorised transactions, but I have to wait till 60 days later for the report to be out," said Ms Ong, a customer of Standard Chartered Bank.

Ms Ong added: "If they found out it's an unauthorised transaction, then of course they will waive the charges. But let's say, if Apple is unwilling to acknowledge this and insists on billing the customers, then the credit card company will have no choice but to bill me the sum, which I'm quite concerned with because according (on) a lot of online forums, I read that according to the US and UK customers, they're actually charged for the amount because Apple company just refused to acknowledge this unauthorised transaction."

One security expert explains how one's iTunes account may have been hacked.

Ngair Teow Hin, chairman, Security & Governance Chapter, Singapore Infocomm Technology Federation, said: "If I want to steal some goods and things with value, I would go for iTunes. If I want to use someone's credit card numbers or someone's account to purchase something so that I can use them, so I can benefit from them.

"If I go to Amazon and buy a book or buy a music CD, I need an address. The goods has to be delivered to me and it makes it a lot easier for the Police, the investigator to find out who I am, where I am and catch me.

"If I want to avoid detection, I will use iTunes to purchase things like music, applications and so on. I only need Internet access, I can be anywhere.

"For people who have their iTunes account being hacked, the usual case is you receive an email that seems like it's coming from Apple.com. You click on a web link and they ask you for your Apple ID and you happily type in your Apple ID and the Apple ID (goes) to the hackers and now they can use your Apple ID to log into your account and purchase anything they want."

One of the affected banks, UOB, has investigated the unauthorised transactions and has reimbursed the full amount to its customers.

Others like DBS Bank and Standard Chartered Bank, advised customers to opt for SMS alerts for all their credit card transactions as an additional defence against fraud.

UOB has urged customers to check their credit card statements for any unauthorised charges.

For safer shopping online, it urged consumers to transact with merchants who have robust security measures in place.

DBS Bank said it has adopted a multi—layered approach to safeguard cardholders from potential credit card fraud.

It sends SMS alerts for credit card transactions above certain pre—set threshold amounts, as well as for first time card usage.

Other than monitoring credit card transactions in real time for unusual or suspicious transactions, DBS sends a one—time password to the mobile phone of the customer who makes online purchases at merchant sites that adopt the 3—Domain Secure protocols by Amex, VISA and MasterCard to authenticate online card transactions.

DBS said cardholders should remain vigilant against card fraud, especially as more turn to shopping online.

Customers should ensure that they're making the purchases from a reputable online store with secured transaction capabilities.

Standard Chartered Bank said it has a security system for Internet transactions called 3D Secure. It also has a dedicated team that monitors and identifies any suspicious transactions on a 24/7 basis for credit card transactions.

— CNA/ck

10 annoying habits your Outlook users need to break

10 annoying habits your Outlook users need to break
By Susan Harkins | March 11, 2012, 8:37 AM PDT
Outlook users probably generate the most annoying calls for support personnel. Word and Excel users want to know how to "do stuff," but Outlook users usually need something fixed. They're not malicious mistakes by any means, but Outlook is a complex tool and users are preoccupied with getting their work done — things just happen. Training goes a long way in many cases. If you can teach your users not to do these 10 things, you and your users will all be happier.

1: Clicking Reply All
When someone sends a message to multiple accounts, the recipients can respond to everyone by choosing Reply All instead of Reply. That means some of your users will get responses they don't need to see. It's a waste of their time. It's probably the most annoying thing Outlook users do. There's no cure for this one except to tell them not to. Some will ignore you, and some will do it accidentally anyway.

2: Using the all list
Many organizations have distribution lists so employees can send the same message to everyone on their team, everyone in the editorial department, all the managers, and so on. But one list usually goes to everyone in the organization. Users rejoice to learn that they can let everyone know when their daughters are selling cookies, when they're going on vacation, when they've moved their office, when they're collecting for a good cause… you see where this is going. This breach of good manners annoys everyone.
Tell your users to use the list judiciously — seldom, if at all. If it becomes a problem, restrict who can use the list.

3: Opening attachments from strangers
Some users see an attachment as a gift — surprise! They just can't help themselves. You can tell users not to open attachments, but good virus protection will usually protect the system, just in case. That's the good news. The bad news is, users still open attachments from strangers.

4: Clicking links
Clicking links is fun. They take you to cool sites with all kinds of offers and fun stuff — and embedded controls and scripts that do all kinds of evil things to the system. Most links are harmless, but most users can't discern a legitimate link from one that leads to a phishing site, hard drive failure, or worse.
Consistent training helps, but experience is the best teacher. Making this mistake carries a heavy fine: The user can't work until someone fixes the system. It's also humiliating and can be a bit scary for them. Implement the best software defenses you can, consistently remind users not to click links in unsolicited emails, and hope for the best.

5: Sharing stuff
I can't help wondering how much bandwidth and storage users waste spreading gossip and sharing angels will save the world chain letters, pictures of their offspring doing adorable things, and so on. Most organizations tolerate this misuse to promote harmony, even if it is annoying and wasteful. It's hard to put a price on good will.

6: Forgetting passwords
Long heavy mournful sigh, followed by a bit of gentle head banging.
Most users don't have to password-protect Outlook, but occasionally, you run into a setup where multiple users access their email via the same machine. To access their account, they have to remember their password. Good luck with that.

7: Ignoring messages
Some users just don't want to communicate via email. They don't like it and they don't want it. But in most organizations, email is no longer a convenience; it's how co-workers interact. Unfortunately, there's always one or two users who refuse to play nicely, who ignore emails or claim, "I never got that message." You can try to correct this behavior through training, but it usually turns into a management issue.

8: Sending email to everyone in their address book
Sending an email to everyone in the address book isn't easy to do — I mean, it's not easy to do by accident. Yet users still manage to do it. This is especially annoying if Outlook adds every sender to the address book as emails arrive. What a wasteful, annoying mess, especially if you have to get the administrator involved to try to recall them. (Just thinking about calling an admin makes me genuflect uncontrollably.) Training won't help here. Just say, "Don't ever do that again."

9: Deleting necessary items
One of the great support mysteries is why Outlook users delete contacts, only to discover they need them after all. This happens with all Outlook items, in fact: emails, tasks, appointments, and so on. You might encourage users not to be so quick to delete items. Let old items hang around for a while until they're truly obsolete. The exception is email; no one benefits from a neglected Inbox.

10: Deleting a profile
Outlook profiles relate accounts and settings to specific users. Most users will have only one, but having more than one is an efficient way to keep things separate. For instance, users might want a profile for work and another for home. You can also accommodate multiple users on the same machine  by creating a profile for each user. Unfortunately, they sometimes delete profiles. I'm not sure how or why they do it, but they do.

http://m.techrepublic.com/blog/10things/10-annoying-habits-your-outlook-users-need-to-break/3110?tag=nl.e101

Everything That Happens In One Day On The Internet

Dina Spector | Mar. 5, 2012, 5:21 PM

Our daily life increasingly revolves around blog posts, emails, and status updates. The folks at mbaonline provide a snapshot of what happens in one day on the Internet. Take a look at the startling numbers below:

My first Facebook imposter experience

My first Facebook imposter experience

By Rich Harris | September 13, 2011, 6:00am PDT

Summary: Social networks have become a playground for hackers. With phishing at an all time high and other methods at getting access to your life, do you feel like there is enough information out there on how to protect yourself?

Earlier this month, I received a friend request from someone I knew I had already connected with last year. I was a little perplexed but sometimes people set up non-work accounts or cancel and then re-sign up so I didn't think much of it. Even though she never really uses Facebook that much because we mostly communicate once a week or less via email, etc., I thought she was getting more active on Facebook and reaching out so I re-accepted.

Randomly on September 2, the same day I got her new friend request, I received a message from what I thought was her: "how are you doing today?" I didn't answer right away as I was bustling around downtown San Francisco and didn't have a chance to get back to her. She hit me up again that same day with another random "hello." Feeling bad that I hadn't responded right away before, I quickly replied with a "Hey [redacted]!"

When I first became suspicious, I perused my friend's account to see how she was using Facebook in general. One person had said on her wall, "Hey I thought we were already connected here, but no problem. Glad to see you on Facebook!" That kinda confirmed my gut feeling that something was weird. What appeared to be her responding to posts on her own wall was not her at all I found out later. Yikes.

As you can see in the screen shots, following the fairly innocuous exchange that almost had me hooked for a second, this person plunges right into a horrible impersonation attempt, not taking into account how random they sound and how obvious this whole sham comes off. How they thought roping Robert Casey Jr. into the conversation would be the clincher I have no idea. On screen shot #4 you can even see where I tried to get them to stop by saying "I know who this is" maybe to psych them out a little bit and yet, they kept on coming back with more.

The scary thing is that this person was interacting with her family, coworkers and friends on her wall pretending to be her. It freaks me out to think about someone trying to interact with my kids while pretending to be me.

Mind your social business

Nowadays, most of the time we can rely on our friends to get a hold of us when something spammy shows up on our Twitter feed or Facebook account that doesn't appear to come from us. In this case though, my coworker had set up an account intended only for checking in with her family every couple of months. The hacker's access to her account set the stage for possible access to hundreds of her friends, family, business connections, etc. without her really knowing until I had emailed her personally. I guess the reminder here is to make sure that if you set up an account anywhere, whether it be email or social network, be sure to consistently check these online properties for your own safety and change your passwords regularly.

Have you or any of your friends' Facebook accounts ever been hacked and/or exploited? How far did it go before you realized what was going on?

Note: When it first happened, I Googled "Robert Casey Jnr" and the email addresses "agenthelpdeaf@gmail.com" and "agenthelpdeaf@yahoo.com" and got nothing. I tried it again before this post, still nothing.

Man in wheelchair falls down elevator shaft (Facebook scam)

Man in wheelchair falls down elevator shaft (Facebook scam)

By Emil Protalinski | September 13, 2011, 12:13pm PDT

Summary: Scammers are taking advantage of ignorant Facebook users by tricking them with claims of a disturbing video of a man in a wheelchair falling down an elevator shaft.

Facebook scammers are once again trying to pique your curiosity with claims of a video of a man in a wheelchair falling down an elevator shaft. Well, if that's really what you want to see, maybe you really do deserved to get scammed.

This version says something along the lines of "Man in wheelchair falls down the elevator shaft *SHOCKING VIDEO*" followed by a link. It also has the following description, according to Sophos: "This Video is really shocking. a man in a wheelchair is falling down the elevator shaft."

Just like the previous "likejacking" scams (a play on the term clickjacking, which means prompting a victim to click something while a different action is taken behind the scenes) any of the above will lead you to a rogue Facebook Page. The fake video player window is overlayed with a hidden iframe; actually clicking on it anywhere will also submit a Facebook Like and spread the post to your Facebook page. You may think you'll eventually get to see a video, but you won't.

The scammers' goal is to drive more traffic towards certain sites. This is how the scammer earns his or her money: a commission for every survey completed, every product purchased, and/or every account compromised. They also use them to spread malware and obtain personal information.

As I've recommended before, if you see a scam like this one, report it. Then go check your own Wall to make sure you're not spreading the scam; the sooner you clean it up and unlike the page, the better. You can even contact Facebook Security if you'd like to. Some security suites as well as the Firefox add-on NoScript will prevent the likejacking from taking place.

Facebook passwords are not case sensitive (update)

Facebook passwords are not case sensitive (update)

By Emil Protalinski | September 13, 2011, 12:26pm PDT

Summary: If you have characters in your Facebook password, there's a second password that you can log in to the social network with.

I just made a small discovery about Facebook passwords: they are not completely case sensitive. If you have characters in your Facebook password (as in, it's not just numbers), there is a second password that will let you log in to the social network.

Earlier today, I needed to check Facebook in Microsoft Internet Explorer 9, my alternative browser to Google Chrome. For whatever reason, I had my caps lock key on. Despite this, I still managed to log in to Facebook just fine.

I did a little investigation and I soon realized what was happening. If you reverse the case of every character in your password, you can still log into Facebook. Seriously, go try it yourself: Facebook Login.

This means that if your password is password1234, you can log in with PASSWORD1234, but not any other combination of lower case and upper case characters. If your password is PaSsWoRd1234, you can log in with pAsSwOrD1234, but not any other combination of lower case and upper case characters.

Even if you have both lower and upper cases in your password, you can still have the caps lock key on when you log in. Just remember to hit the shift key in the right places, and you'll still get in fine.

This really isn't a huge security problem, although if someone is trying to brute force your Facebook account, they can technically try significantly fewer passwords.

I'm not sure if this is by design or not, so I've contacted Facebook and asked for clarification.

Update: This is by design after all. I got in touch with Fred Wolens at the Facebook PR security team and he explained the details to me. Here is what I learned (I also asked him for a written statement, which I'll update the post with again when I get it).

Facebook actually accepts three forms of your password:

1. Your original password.
2. Your original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
3. Your original password with the case reversed, for those with a caps lock key on.

The third case is the one I stumbled upon today. Wolens told me Facebook has had this implemented "for a while" although he couldn't say for exactly how long. He also noted that Facebook doesn't believe this impact the security of the user's passwords, since the characters are still unique, just flipped.

Wolens made a point to emphasize Facebook still has a number of security checks that happen even after the password is accepted. For example, if you log in from a questionable device, or if you log in from two locations that are very far apart from each other, it will prompt you with a verification code.

Facebook may say there's low risk in its password practices, but this comes off as blasé, according to my colleague Ryan Naraine. Ease of use can turn into a security problem down the road, which is why many services will warn you to make sure the caps lock is off instead of simply allowing a "flipped" version of your password.

Update 2: "Nothing is more important to us than the security of our users and their information," a Facebook spokesperson said in a statement. "Our passwords are not case insensitive. We accept three forms of the user's password to help overcome the most common reasons that authentic logins are rejected. In addition to the original password, we also accept the password if a user inadvertently has caps lock enabled or their mobile device automatically capitalizes the first character of the password. We feel this does not significantly impact the security of the user's password or their account. Additionally, we do not store our passwords in plain text we use several encryption technologies and techniques to maintain the security of our information."

6 simple steps to start e-marketing successfully

6 simple steps to start e-marketing successfully

By Matthew Kwan | Jun 12, 2009

Starting e-Marketing is easy but walking on the right path is not so easy. There are just too may options you can consider! However, typically I would recommend my clients to follow 6 simple steps to plan and start doing e-Marketing and they are:

1. Building Effective Website
2. Designing Compelling Messaging
3. Sending Strategic Newsletters
4. Online Advertising
5. Managing Customer Databases
6. Building Alliances

1. Building an Effective Website - I have shared in other articles how important it is a website for e-Marketing to be successful. It is not only design and layout but also the real business strategy behind. You have to consciously to make your website effective for your business and engaging your customers interactively. A website will only perform well when it is being revised and updated according to the environmental changes with Compelling Messaging.
2. Designing Compelling Messaging - It is really back to marketing basics about communications. You have to high play your products/services' benefits rather than functionality in order to distinguish your differential advantages over your competition. A lot of time, customers' buying decisions are based on trusts that built on the success references you are giving of other cases. Before you get this right, e-Marketing will never be a success.
3. Sending Strategic Newsletters - e-Newsletters are so easy to send out if you have any emails of our suppliers, partners, customers and prospects. However, your compelling messaging must be ready before your e-Newsletters can be successful. In additional, you need to send out useful information or knowledge occasionally other than sales promotions in order to attract your target audience to keep subscribing your newsletter.
4. Online Advertising - The most basic Online Advertising option I recommend is Search Engine Marketing. It is becoming mandatory for any companies nowadays to make sure their company information/advertisements are showing on the first page of search results. Without doing this, your website will just never be found in a very long while!! Other Online Advertising options can be Web Banner Ad on your target customers populated websites or contextual advertising, etc.
5. Managing Customer Databases - When you start doing e-Marketing, the next important thing is to keep up with your customer database(s). This is very crucial because your customer database will grow throughout your e-Marketing activities. The most basic way to do this is to use Excel or Outlook or any other mail clients but as you grow your customer database, it is better to adopt a Customer Relationship Management software or a e-Marketing campaign software.
6. Building Alliances - No one can be successful by doing e-Marketing alone and this is the fact! Hence, building alliances and letting your alliances to promote your products/services in their websites and other channels are the very key to success with e-Marketing. You potential return on investment (ROI) will grow even better than you can imagine.

After all, e-Marketing is just Marketing, companies need to be applying the basic marketing techniques in order to be successful. However, this internet age is making the situation so interesting that you can exercise your marketing creativities with a lot of opportunities and alternatives!

By Matthew Kwan © Copyright 2008. All rights reserved.
Principal Consultant
Adams Company Limited www.adamshk.com

As far as I am concerned

Submitted by renny angels on 3 December 2009 - 3:56am.

As far as I am concerned internet marketing is far more complex than that and I've never consider it easy. Each of these six steps divide in many other steps with great importance for a good web marketing strategy. I've subscribed to Clickbooth affiliate as part of a website promotion action, I am about to start a SEO campaign and there are other plans after that too. Internet marketing never stops and it doesn't get easier.

Tesco: Homeplus Subway Virtual Store (Movie)

When your data's in the cloud, is it still your data?

Your contract with a cloud provider should have language clearly affirming your ownership of your data

Thomas J. Trappler

 

January 17, 2012 (Computerworld)

When your data resides on a cloud provider's infrastructure, your ownership rights could be compromised. For example, what's to prevent the cloud provider from deciding to access your data and use it for its own purposes? That's why any contract for cloud services should include language clearly affirming your ownership of your data.

The good news is that well-established cloud vendors are beginning to include language along these lines in their standard contracts. For example, section 10.2 of the Amazon Web Services contract states:

"Your Applications, Data and Content. Other than the rights and interests expressly set forth in this Agreement, and excluding Amazon Properties and works derived from Amazon Properties, you reserve all right, title and interest (including all intellectual property and proprietary rights) in and to Your Content."

It hasn't always been this way with cloud computing, but as customers have voiced their ownership requirements, providers have made improvements in this area. As the cloud continues to evolve, if customers clearly state their needs, then smart cloud providers will listen and respond.

Depending on the nature of your data and how it's processed in the cloud, it may also be necessary for the contract to include language affirming your institution's ownership of the results of any processing of its data that occurs while on the cloud provider's system.

With ownership clarified, the next step is to identify the limitations on how the cloud provider may use your data. In most cases, you'll want to limit the provider's use solely to that which is necessary for it to fulfill its obligations under the contract. It is also prudent to specifically exclude the provider from any mining of your data.

Be ready for the divorce

Once your data and processes have moved to cloud, you become more dependent upon the provider. You could be locked into its services, a situation that increases the cloud providers leverage over you in negotiating contract terms.

I know this sounds like advising someone to find a divorce lawyer before getting married, but to mitigate the risk of vendor lock-in, you need to plan in advance for the eventuality that you may decide to switch to a different provider or bring your data and processes back in-house. With this in mind, the contract should state your rights to access your data on an ongoing basis. Specifically, the contract should:

* Describe the process by which your data will be returned, whether done midterm or upon contract termination.

* State the amount of time the provider will have to turn over your data.

* Specify that the data must be provided in a commonly used format that is pertinent to your expected needs, and not in a proprietary or otherwise inaccessible format.

* Define how long after termination of the contract your data will remain accessible.

* Quantify the cost to you (ideally none) to export your data.

Some vendors have begun to embrace these ideas. For example, see Google's Data Liberation Front efforts and Microsoft's Office 365 commitments regarding Data Portability.

Other access issues

When codifying your rights to access your data, be sure to consider emergency situations. For example, e-discovery obligations to preserve, collect and produce data for litigation-related discovery actions can be more difficult to comply with when your data is in the cloud, because you do not have direct control. Yet your failure to produce pertinent data in a timely manner can result in significant fines. This risk can be mitigated by contractually requiring the cloud provider to establish mechanisms by which you can retrieve your data within a specified time frame.

Finally, the contract should obligate the provider to destroy your data after termination of the contract and should specify the manner in which this should be done, the time frame for doing so, the need for the cloud provider to produce certification of destruction, and your right to audit.

Join me at UCLA on Jan. 19-20 for my seminar "Contracting for Cloud Computing Services."

Thomas Trappler is director of software licensing at the University of California, Los Angeles, and a nationally recognized expert, consultant and published author in cloud computing risk mitigation via contract negotiation and vendor management. For more information, please visit thomastrappler.com.

Healthcare Industry CIOs, CSOs Must Improve Security

Mar 06, 2012 09:39 am | CIO.com

by Thor Olavsrud

Protected health information (PHI) data breaches are growing in frequency and magnitude as the healthcare industry moves to adopt electronic health records (EHR), say a group of standards and security organizations. The healthcare industry must take action to better defend PHI if it wants to keep the public's trust, they say.

The Identity Theft Prevention and Identity Management Standards Panel (IDSP) of the American National Standards Institute (ANSI), in partnership with The Santa Fe Group/Shared Assessments Program Healthcare Working Group and the Internet Security Alliance (ISA), on Monday unveiled a report, The Financial Impact of Breached Protected Health Information: A Business Case for Enhanced PHI Security, at a press conference kicked off by White House Cybersecurity Coordinator Howard A. Schmidt. The report is intended to help CIOs, CSOs and IT security, privacy and compliance staff create a compelling business case for enhanced security to present to business executives.

"When it comes to cybersecurity, we all have a role whether we're a consumer, the executive of a company or a political leader," Schmidt says. "By working together, we can make sure we make the improvements that ensure the balance between privacy rights and security. While we can't solve all the problems in the world when it comes to cybersecurity and privacy, we can affect those parts we're responsible for."

Privacy Protections Critical to Trust

Joe Bhatia, president and CEO of ANSI, added, "Privacy protections are absolutely critical to maintaining consumer trust in this information age. In the U.S., the healthcare delivery system is founded upon trust. This trust, as we all know, is now being severely tested."

According to the 67-page report, which involved a cross-section of more than 100 healthcare industry leaders from more than 70 organizations, nearly 39.5 million EHRs were breached between 2005 and 2008. In addition, within the past two years, the health information privacy of nearly 18 million Americans-a number roughly comparable to the population of the state of Florida-was breached electronically.

The data points don't end there. Between September 2011 and November 2011, a government benefits program suffered the theft of EHRs of 4.9 million military personnel, the health information of 4 million patients of a reputable West Coast healthcare system were stolen electronically and a major academic medical center inadvertently disclosed the EHRs of 20,000 of its patients. In November of last year, Ponemon Institute completed a survey of 72 provider organizations and found that 96 percent of respondents reported at least one data breach in the past 24 months. On average, Ponemon Institute found that health organizations have experienced four data breach incidents over the past two years.

"Healthcare is one of the most-breached industries," says Dr. Larry Ponemon, chairman and founder of Ponemon Institute. "Healthcare providers and supporting organizations don't currently have sufficient security and privacy budgets, including adequate processes and resources, to protect sensitive patient data."

"The entire healthcare delivery system depends upon a single transaction: your willingness to share the most intimate details of your personal information with your physician," adds James C. Pyles, panel member and principal with Powers Pyles Sutter & Verville PC. "You have to trust that the information won't be used to harm you or your children. If you're dealing in this business of handling health information electronically or any information electronically, you're touching on a very tender nerve that people have."

Pyles added, "It's more than breaches, it's also understanding, as a business, the expectations of your customers. If you frustrate those expectations, I promise you, you will be sued."

Part of the problem, says Catherine Allen, chairman and CEO of The Santa Fe Group, is that the financial incentives are on the side of those who seek to steal medical records. Allen said medical records go for $50 a record on the underground market, making them much more lucrative than even financial information. "It's very valuable data," she says.

Evaluating the Cost of Data Breaches

The new report is intended to be a tool to help organizations quantify overall potential data breach costs and to provide a methodology for determining an appropriate level of investment needed to strengthen privacy and security programs and reduce the probability of a breach.

"No organization can afford to ignore the potential consequences of a data breach," says Rick Kam, president and co-founder of ID Experts and chair of the PHI Project. "We assembled this working group to drive a meaningful dialogue on appropriate levels of investment to better protect healthcare organizations and PHI."

He added, "One of the things that we realized as we started to work through this process is that the chief information officer, the chief security officer, they're essentially getting outgunned by the criminals. It's not that we don't have the technology or processes or people to deal with this problem. It's that we don't have enough focus and investment from the executives."

The report provides a five-step method, the PHI Value Estimator (PHIve), for estimating breach costs and what needs to be done to protect organizations. The PHIve provides detailed information about each of the steps, which include: conducting a risk assessment, determining your security readiness score, assessing the relevance of a cost, determining the impact and calculating the total cost of a breach.

"Cybersecurity is not an IT issue," says Larry Clinton, president and CEO of the Internet Security Alliance. "It is an enterprise-wide risk management issue that needs to be addressed in a much broader sense."

Thor Olavsrud is a senior writer for CIO.com. Follow him @ThorOlavsrud.