ID Fraud and Your Taxes - Take Action!

   It's that time of year again.  Brian Krebs just put out two articles on the ongoing issue of tax fraud.  As is so often the case, the advice to protect yourself hasn't changed - and be assured, you must protect yourself because no one else will, certainly not the IRS!

   As noted below and in the Krebs' article, what you need to do now and always is:

1. file your taxes early
2. monitor your credit (I covered that topic here... in 2013!)
3. freeze your credit (two articles from Krebs, also from 2015)
4. become you before someone else becomes you (I wrote about that subject here and here)

   Here's a re-run of my article on this subject from three years ago.  It's all still true!  As I wrote nearly 5 years ago, the more things change the more they stay the same.

---

   I did a series of posts last year (2014) on the problem of ID Fraud.  This is an ongoing issue, certainly because organizations struggle to protect information, there are cyber attackers out there, and also individuals don't often take steps to protect their own information.

   The bottom line is that your personal information, primarily your financial information, has tangible dollar value to a cyber attacker.

   We usually think about credit card fraud or maybe bank account fraud as the results of these kinds of data breaches.  But in this post and the next I'd like to talk about two other scenarios that have happened, are happening... and you need to be aware.

   It's that wonderful time of year again in the US.  Crisp weather, snow (most places), the days are starting to get a bit longer... and it's the beginning of tax filing season.

   Imagine you are doing your civic duty, filling out and filing your tax return.  You send it in to the IRS, only to find out that "you" already filed your return and "you' have already received your rather sizable refund - surprise!

   Unfortunately, this has happened.  And, as we've discussed in the past, these attackers are smart.  This is a business.  They need to be able to maximize profits because there is a limited timeframe in which to commit the crime.  So they need to attack a sub-population who:

1. makes good money;
2. might have many deductions;
3. might have complex returns, and;
4. for whom a large refund might not raise red flags.

   How about... Doctors!

   And, just as I finishing writing this article, we have new news out about tax fraud this year!  Reports say this is connected with Turbo Tax software, but it is more likely that scammers got people's info through other means and filed the fraudulent returns.  Maybe Turbo Tax is just the scammers software of choice! :-)

   As always, we want to talk about what you can do.

   In addition to the steps outlined in these previous blog posts, here is the IRS Guide on Identity Theft.  The IRS guide and my previous tips talk about not only what you should do if you are a victim, but tips to avoid the problem in the first place including:

• protecting your personal information, primarily your social security number
• don't click on links sent to you via email or in social media - type the link in yourself or do a search
• use link rating applications like Web Of Trust (WOT)
• don't give our your personal information via web, email, phone unless you can positively identify the person on the other end
• review your bills, credit record and other information that might provide early warning of a problem.

   Have you been the victim of tax-related ID Fraud?  Do you have any additional tips to share?

   Of course, this issue is not just about doctors!  Next time we'll talk about something perhaps even closer to your wallet... payroll fraud and misuse.

Ho-Ho-Holiday Spams and Scams

   It's that time of year again folks.  And whatever holiday you may, or may not, celebrate... there's something we're all likely to see.  It's not presents, though maybe there are some for you.  It's not snow, though we're already seeing that here in the upper midwest US.

   It's malware and holiday scams!

   Unfortunately, it happens every year.  Sometimes it's malicious attachments.  Sometimes it's links to malware to download or phishing sites with forms ready to collect your personal and financial information.

   Here is my 2017 edition of my Top 10 Tips To Avoid Holiday Spams and Scams...

Internet Safety for our Parents

   It's US Cyber Security Month and the key themes I've been discussing here for years are very bit as relevant today.  In honor of Cyber Security Month I'm re-running a post from 2016.  The more things change, the more they stay the same.  Happy Cyber Security Month!

---

   I've written about Internet safety for families, kids, teens and I've even spoken on safety for pre-schoolers.  But it's important to think about online safety for parents as well.

   That's true both for parents of young children was well seniors with grown children.  The safety challenges for seniors are similar but there are some differences.  They may not be as familiar with technology and, according to the FBI:

• they are often financially secure and/or have good credit
• they may be more trusting and they don't think they'd be a target

   This article by the AARP lists some common scams against seniors including some we've discussed like fake Microsoft support calls or IRS-related tax fraud.

   What got me thinking about this topic was a great article entitled "10 Ways to Help Our Parents With Online Security".  The article touches on a number of themes we've discussed in the past.  I'll list the 10 items with links back to some past editions of this blog - typically they:

1. don't think they have anything worth stealing
2. have bad password habits - just like most people
3. are confused by 2-factor authentication - something we all should use
4. leave mobile devices unattended and without security measures
5. don't recognize phishing emails
6. don't understand social media and how it can be used in scams
7. share too much information
8. can be manipulated by online media
9. place too much trust in an anti-virus product
10. don't understand how sophisticated scams and attacks can be

   In what ways can you help your parents stay safe online?

I Have Neither Read Nor Understood

   The site masthead starts out with the statement:“I have read and agree to the Terms” is the biggest lie on the web. We aim to fix that.

   This is the lead statement on the tosdr.org website.  tosdr is an acronym for "Terms of Service; Didn't Read".  It's a play on words (play on acronyms? :-)) of tl;dr, Too Long; Didn't Read.  tl;dr has been a term floating around the interwebs for many years.  It simply expresses a sentiment that many people can relate to... that we're busy, so when there is a long article, post, whitepaper, document, documentation, etc., we might just not read it.  That also leads to the idea of the tl;dr version, i.e. executive summary!

   Clearly, Terms of Service statements fit into this category.  They tend to be exceedingly long.  They are often written FLBL (For Lawyers, By Lawyers)! :-)  You see them all over the place... on your bank's website, on social media sites, when you sign up for just about any kind of service, and with just about every app you install.

   So, if no one reads them, what's the problem?  Like a contract, the Terms of Service or EULA (End User License Agreement) provides some very important information.  For example, it may cover:

• how the app, website or company can use your personal data;
• if the site can sell your data,
• whether or not you own any content you upload (such as to a social media site);
• how, when, how much you can use the app, service or website;
• if the site can charge you money, either one time or ongoing;
• if you have any rights to seek damages against the company if you don't like how they conduct business
• and more...

ID Fraud, Taxes and Doctors Again (Still?)

   It's that time of year again.  Brian Krebs just put out an article on "darkweb" sales of W-2 information.  You can read that article here.  As is so often the case, the advice to protect yourself hasn't changed - and be assured, you must protect yourself because no one else will, certainly not the IRS!

   As noted below and in the Krebs' article, what you need to do now and always is:

1. file your taxes early
2. monitor your credit (I covered that topic here... in 2013!)
3. freeze your credit (two articles from Krebs, also from 2015)
4. become you before someone else becomes you (I wrote about that subject here)

   Here's a re-run of my article on this subject from two years ago.  It's all still true...

---

   I did a series of posts last year (2014) on the problem of ID Fraud.  This is an ongoing issue, certainly because organizations struggle to protect information, there are cyber attackers out there, and also individuals don't often take steps to protect their own information.

   The bottom line is that your personal information, primarily your financial information, has tangible dollar value to a cyber attacker.

   We usually think about credit card fraud or maybe bank account fraud as the results of these kinds of data breaches.  But in this post and the next I'd like to talk about two other scenarios that have happened, are happening... and you need to be aware.

   It's that wonderful time of year again in the US.  Crisp weather, snow (most places), the days are starting to get a bit longer... and it's the beginning of tax filing season.

   Imagine you are doing your civic duty, filling out and filing your tax return.  You send it in to the IRS, only to find out that "you" already filed your return and "you' have already received your rather sizable refund - surprise!

   Unfortunately, this has happened.  And, as we've discussed in the past, these attackers are smart.  This is a business.  They need to be able to maximize profits because there is a limited timeframe in which to commit the crime.  So they need to attack a sub-population who:

1. makes good money;
2. might have many deductions;
3. might have complex returns, and;
4. for whom a large refund might not raise red flags.

   How about... Doctors!

   And, just as I finishing writing this article, we have new news out about tax fraud this year!  Reports say this is connected with Turbo Tax software, but it is more likely that scammers got people's info through other means and filed the fraudulent returns.  Maybe Turbo Tax is just the scammers software of choice! :-)

   As always, we want to talk about what you can do.

   In addition to the steps outlined in these previous blog posts, here is the IRS Guide on Identity Theft.  The IRS guide and my previous tips talk about not only what you should do if you are a victim, but tips to avoid the problem in the first place including:

• protecting your personal information, primarily your social security number
• don't click on links sent to you via email or in social media - type the link in yourself or do a search
• use link rating applications like Web Of Trust (WOT)
• don't give our your personal information via web, email, phone unless you can positively identify the person on the other end
• review your bills, credit record and other information that might provide early warning of a problem.

   Have you been the victim of tax-related ID Fraud?  Do you have any additional tips to share?

   Of course, this issue is not just about doctors!  Next time we'll talk about something perhaps even closer to your wallet... payroll fraud and misuse.

(Browser) Caching Fire

   Someone recently asked me a question about the safety of allowing your web browser to save, and then auto-fill, passwords.  That's a very timely question because that issue has been in the news lately.

   Web browsers have all kinds of built-in capabilities.  One "feature" that is only a few years old is the ability to save information you might put into forms such as: your name and address, phone number and other contact info, credit card information.  Browsers can also save your userids and passwords for sites, then automatically fill in that info when you visit the site.

   I've always said that security-minded people should not allow web browsers to save this kind of personal and security info.  This is primarily because all browsers have a track record of having many vulnerabilities.  I've always "said" this but, as it turns out, I've never written about it!  It's about time! [Note... or so I thought! While looking for some other info, I found that I did talk about this issue back in 2013!]

   There are two primary reasons why allowing the browser to save sensitive information is a bad idea:

1. Copycat and phishing websites can grab information directly your browser has stored without your knowledge.  This is the problem that was recently announced.
2. As I just mentioned, browsers have many vulnerabilities and exploits. At this year's Pwn2Own contest (a 2-day event at which teams compete to exploit software vulnerabilities for cash prizes), all of the major browser fell victim!

   The latest issue that was discovered occurs when you are lured to a specially crafted website.  That happens more often than you might think

Internet Safety for Parents

   I've written about Internet safety for families, kids, teens and I've even spoken on safety for pre-schoolers.  But it's important to think about online safety for parents as well.

   That's true both for parents of young children was well seniors with grown children.  The safety challenges for seniors are similar but there are some differences.  They may not be as familiar with technology and, according to the FBI:

• they are often financially secure and/or have good credit
• they may be more trusting and they don't think they'd be a target

   This article by the AARP lists some common scams against seniors including some we've discussed like fake Microsoft support calls or IRS-related tax fraud.

   What got me thinking about this topic was a great article entitled "10 Ways to Help Our Parents With Online Security".  The article touches on a number of themes we've discussed in the past.  I'll list the 10 items with links back to some past editions of this blog - typically they:

1. don't think they have anything worth stealing
2. have bad password habits - just like most people
3. are confused by 2-factor authentication - something we all should use
4. leave mobile devices unattended and without security measures
5. don't recognize phishing emails
6. don't understand social media and how it can be used in scams
7. share too much information
8. can be manipulated by online media
9. place too much trust in an anti-virus product
10. don't understand how sophisticated scams and attacks can be

   In what ways can you help your parents stay safe online?

What You Can''t See Can Hurt You(r Data)

   "It is all around us, even now in this very room. You can see it when you look out your window or when you turn on your television. You can feel it when you go to work, when you go to church, when you pay your taxes.."

   It's "all around you. Here, between you, me, the tree, the rock, everywhere."

   No, not the Matrix and not the Force, but a more insidious power... WiFi!

   Public WiFi is everywhere.  Many stores, malls, airports, cities and even parks offer it.  Sometimes it's free and sometimes not.

   It's US Cyber Security Awareness Month so it's a good time to think about the risks of using public WiFi and how to protect yourself.

   There are definitely risks in using public WiFi including:

• pushing software - WiFi can be configured to send software to your device when you connect.  That might be OK at home or important in the office, but it can be misused by an attacker out in public.  Don't install software offered to you on a public WiFi.
• redirecting your browsing - a WiFi connection can control how you get to websites.  If an attacker controls the WiFi, they can cause you to go to copycat websites with malicious software or to phishing sites.
• evil twin attack - you know when you're at the coffee shop and you can connect with a WiFi connection that has the same name as that coffee shop?  How do you know it's really the coffee shop's connection?  You don't.  Anyone can buy a wireless router at the store for $25, put it anywhere, and name it anything they want.  Using a deceptive name for a WiFi connection to lure people is called the evil twin attack.
• are you encrypted? - VPNs, Virtual Private Networks or secure connections, are a great way to protect your data when connecting over unknown networks... like the Internet!  However, you first have to connect to the Internet before establishing the VPN.

Here are some tips to reduce your risks of using WiFi outside your home or office:

• use your smartphone hotspot - if this is a feature of your mobile phone and plan, you can use your phone as a WiFi hotspot and connect to it.  You then can feel confident that your connection is going through your cellular carrier.  Warning... this will use your mobile data and may cost you extra depending upon your plan and data limits.
• only use wifi with a password or passphrase - even if everyone knows the password.  Using WPA or WPA2 with a password/passphrase means that every connection between a PC and the wireless network is encrypted.
• turn off file sharing - in Windows you can designate a network as public, work or home, or you can directly turn off file sharing.  Here's an article with the instructions.
• if possible don't use open wifi in very open areas - the more open an area you're in, the harder it is to figure out if you're connected to a legit WiFi.  And...
• be aware of your surroundings - it's not strictly a WiFi issue, but when you're on public WiFi you're in... Public!  Protect your screen.  Protect your passwords.

   Even if you do all this, a skilled attacker can still cause you problems on a public WiFi network.  So, if you have to use public WiFi, try to:

• limit personal info - even if it looks like a website is https, do your personal business from a secure connection at home
• same for banking, shopping - definitely save your financial transactions for known secure connections
• use care with confidential work data - you should use care when dealing with critical work data, particularly if you work with other peoples' personal data!

   Here are a few articles with more info.

   As a side note, there are also questions about potential health risks of all the wireless signals in our environment.  It's hard to separate fact from speculation and wireless may or may not be a health issue.

   In the future we'll see even more wireless than we do now.  And we'll also see better wireless network security.  Many new cars come with WiFi hotspots and more cities and municipalities are offering wireless. 

   What are your tips for public WiFi safety?  Have you ever come across an "evil twin" WiFi network?

Gotta Catch Some of 'Em

   Because you just can't catch 'em all!

   I guess I can't get around having to comment on Pokemon Go.

   If you have children, or if you were, born in the 90's through the 00's then you know all about Pokemon.  It used to be about the cards, action figures and, of course, the video games.  Remember the Game Boys, game cartridges and all the sounds and music?!

   With Pokemon Go, the game has gone from sometimes mobile to really mobile.  And from sometimes social to a social phenomenon.

   It's not farfetch'd!

   For some reason, many adults seem to dislike this game, siting issues like inattention to surroundings, time spent playing, etc.  I think the game is great!  Here are my top reasons why (major caveat... I have not actually played the game!  These are my observations as a technology and security professional and as a parent):

• It gets kids out of the house - many people need a little Vitamin D.  One of the biggest complaints about gaming and computers for kids is that they don't get outside enough.
• It gets kids moving - #exercise.  While there have been some attempts at game-ifying exercise, such as Wii Fit, it never really caught on.  Pokemon Go gets people outdoors and moving around.  In fact, part of the game is logging lots of steps.
• It's for "kids" of all ages - parents can play along with their kids!  You don't have to play, but at the very least it's a great opportunity to be involved.
• It's really social - you may remember that, back in the day, players could connect two Gameboys so two people could battle.  Now people are connecting IRL (In Real Life) as they hike trails, walk through cities or congregate at parks or other PokeStops.
• It's another step toward acceptance of Augmented Reality.  Unlike Virtual Reality, in which one is entirely immersed in a manufactured visual scene, Augmented Reality overlays images, text or other information on top of what you are actually looking at.

The Celebration Continues! - Your Evolving Digital Life

   We continue our celebration of US Cyber Security Awareness month!  This partnership between Homeland Security, NCSA (National Cyber Security Alliance) and the MS-ISAC (Multi-State Information Sharing and Analysis Center) is an opportunity to recognize the importance of information security.  It started in 2003 as a way to build awareness for online security and privacy and to encourage individuals, business and government.

   This is another of my weekly posts connected with the weekly themes put together by DHS.  This week the theme is Your Evolving Digital Life.

   You practically need to be online to survive and thrive in today's world.  Whether we're talking about digital natives or newbies, we all need to handle some aspects of our lives online.  And all ages are involved!  Senior Citizens are the fastest growing online demographic group.  Not to be outdone, over 33% of babies born in the US already have some kind of online presence!  And people aren't the only online residents... our refrigerators, cars, scales, light bulbs, power grids and medical devices have joined us.

Keep Celebrating! - Mobile and Social

   We continue our celebration of US Cyber Security Awareness month!  This partnership between Homeland Security, NCSA (National Cyber Security Alliance) and the MS-ISAC (Multi-State Information Sharing and Analysis Center) is an opportunity to recognize the importance of information security.  It started in 2003 as a way to build awareness for online security and privacy and to encourage individuals, business and government.

   This is another of my weekly posts connected with the weekly themes put together by DHS.  This week the theme is staying protected while always connected.  That rhymes!

   We are always connected!  According to the Pew Research Center, in 2015 90% of american adults own a cell phone, 64% own a smart phone.  And one of the major uses for smart phones is... not calls but social media!  How do we stay safe online and on the move?

Do Strong, Unique Passwords Matter?

   Yes!

Bring It On Home

   I'm giving a presentation at the Twin Cities ISSA Security Awareness SIG.  I'll be talking about a number of different methods I've used over the years to create buzz and interest about security and make topics accessible to everyone.

   I was planning to refer to one of my earliest blog posts, covering my general philosophy on this topic.  But... going through past posts it appears that, while I've alluded to the ideas, I never actually wrote the post!  So I'll do that now!

   Like the song says, I try to bring it on home.  I find that while people do want to understand security rules at work, when we start talking about things like home computers, smart phones and family internet safety, then we get peoples' attention.

   And that's a great thing!  For a bunch of reasons:

• When people think about protecting themselves and family and data, it helps them remember that in the office we are protecting customers'/patients'/users' privacy and data.
• Security needs the eyes and ears of all staff to help us know what is going on.  Security Awareness focusing on personal topics helps open the communication channels to the security team.  We're not so scary! :-)
• When staff understand more about how security topics can help them, we gain real evangelists.

   And yet there is still controversy about the usefulness of Security Awareness.  But I think it's one of the most important and useful things we can do to help secure our environments.

   Here's a link to the slides from my presentation.

   And here are a few of my past favorite security awareness posts:

• Celebrate Cyber-Style!
• The More Things Change...
• Tech-Smart Parents and Preschoolers
• Online Self Defense (series)
• Internet Safety... The Song Remains the Same

   If you are a computer use, what are some topics you'd like to learn more about?

   If you are an information security professional, what tips and techniques would you like to share?

ID Fraud... What to do Now

   I've written about Identity Fraud in the past.  Today I'd like to review what you need to do now if you are a victim.  I have written about this before, but a picture is worth a thousand words... and a video?...

It Wasn't Englebart's Fault! (part 1)

   Douglas Englebart was an engineer, inventor and pioneer of the early internet.  He died in 2013.  He was known for a number of key ideas and inventions.  In 1967, he invented a very useful computer device that is a key component in propagating malware and facilitating phishing attacks... the Mouse!

   Of course, Englebart didn't invent email, email attachments, phishing emails or malicious links.

   The media is always buzzing with information about the latest breach or computer break-in.  We hear about advanced attacks, nation-states and possibility of cyber-war.  Many of these major attacks start with a simple click (or many clicks).

   Two of the main ways that malware is distributed or information is stolen is via:

• malicious attachments sent in an email, and;
• phishing emails with malicious links.

   For either of these methods to work, the recipient of the email needs to click... with a mouse! (well, you could also use a track-pad or track-ball).  The attachment needs to be opened.  If it's a zip file, it needs to be unzip'd.  If it's a link, clicking the link might either download malware or lead to a form asking for personal information.  Any of these actions could cause major problems.

   Let's discuss two issues:

• what do these viruses do?
• why can't my organization stop these? (or why can't I stop them at home?)

   This is, unfortunately, pretty complex and we'll probably handle these in two separate posts.

Why Viruses?

   As I've discussed in the past, this is really an economics issue.  There's illicit money to be made and there are smart people out there coming up with new ways to attack and take over systems.

   A typical computer virus does 1 of 3 things (I'm using the term virus generically - a virus is actually just one of a number of different types of malware (malicious software)).  It can even do more than one of these:

1. connect "home" and download more viruses;
       This is an optional step.  The real goals are items #2 and #3.
2. take over a computer so it can be remotely controlled, or;
       An attacker can take over a bunch of computers and use them to attack other computers or sell that capability to others. The computers taken over are called robots or bots.  They can be used to spread spam and more malware; to send a lot of traffic at target computers so they won't work properly or at all (this is called Denial of Service or DoS), or; might use other attack methods.
3. steal information (the techy word for this is exfiltration).
       The stolen personal or corporate information can be sold or used to steal money from existing or newly created accounts.
4. (bonus item) threaten to do the above (blackmail).
       An attacker might threaten to crash computers if not paid.  One kind of malware called "ransomware" encrypts your files so that only the attacker can decrypt them and charges you a fee to get your access back.

What can we do?

   This is a complex issue and we'll talk about protection methods next time.  For now, the best advice is to take measures we've often discussed here:

• use anti-malware software
• use care when opening attachments
• use care when clicking on links
• know who sent you that email, message, tweet, social network message, etc.

   I discussed these and other steps you can take in a post last year.

ID Fraud, Taxes and Doctors, Oh My!

   I did a series of posts last year on the problem of ID Fraud.  This is an ongoing issue, certainly because organizations struggle to protect information, there are cyber attackers out there, and also individuals don't often take steps to protect their own information.

   The bottom line is that your personal information, primarily your financial information, has tangible dollar value to a cyber attacker.

   We usually think about credit card fraud or maybe bank account fraud as the results of these kinds of data breaches.  But in this post and the next I'd like to talk about two other scenarios that have happened, are happening... and you need to be aware.

   It's that wonderful time of year again in the US.  Crisp weather, snow (most places), the days are starting to get a bit longer... and it's the beginning of tax filing season.

   Imagine you are doing your civic duty, filling out and filing your tax return.  You send it in to the IRS, only to find out that "you" already filed your return and "you' have already received your rather sizable refund - surprise!

   Unfortunately, this has happened.  And, as we've discussed in the past, these attackers are smart.  This is a business.  They need to be able to maximize profits because there is a limited timeframe in which to commit the crime.  So they need to attack a sub-population who:

1. makes good money;
2. might have many deductions;
3. might have complex returns, and;
4. for whom a large refund might not raise red flags.

   How about... Doctors!

   And, just as I finishing writing this article, we have new news out about tax fraud this year!  Reports say this is connected with Turbo Tax software, but it is more likely that scammers got people's info through other means and filed the fraudulent returns.  Maybe Turbo Tax is just the scammers software of choice! :-)

   As always, we want to talk about what you can do.

   In addition to the steps outlined in these previous blog posts, here is the IRS Guide on Identity Theft.  The IRS guide and my previous tips talk about not only what you should do if you are a victim, but tips to avoid the problem in the first place including:

• protecting your personal information, primarily your social security number
• don't click on links sent to you via email or in social media - type the link in yourself or do a search
• use link rating applications like Web Of Trust (WOT)
• don't give our your personal information via web, email, phone unless you can positively identify the person on the other end
• review your bills, credit record and other information that might provide early warning of a problem.

   Have you been the victim of tax-related ID Fraud?  Do you have any additional tips to share?

   Of course, this issue is not just about doctors!  Next time we'll talk about something perhaps even closer to your wallet... payroll fraud and misuse.

Beach to Breach - It's not just for work data!

   I heard a great term recently... Beach to Breach.  SC Magazine did an article about a Sourcfire study on employees bringing their portable devices on vacation.  They found that 77% of employees bring their devices with them on vacation to keep in touch with work and that 97% of the use is email.

   Hopefully you can see some of the security problems right away... the devices have a good chance of getting lost or stolen when one is out of their "element"; plenty of opportunities to connect to unknown networks; potential to use hotel printers; possible "incentive" to bypass controls to see that one "important" message, and of course; sand in our devices!

   Organizations certainly should be concerned about the potential for breach of data or loss of equipment.  But what about the rest of us?  Should we take extra precautions with our personal devices and information when out of town?... Definitely!

Internet Safety... The Song Remains the Same

   As seems to often be the case in the fall, I'm doing a number of Internet Safety talks lately.  Maybe it's the tie-in with October US Cybersecurity month, and I did some posts celebrating that.  Maybe it's that fall makes us think about back to school (though maybe safety should be a "hotter" topic in the summer when kids have more free time!).

   I've been presenting to groups about Internet Safety and related topics for over 12 years.  I've got a few events coming up at work, so I'm updating my material.  I've got a number of talks on these "consumer" issues.  You can see my slides on my slideshare page.  I regularly update my material.  But what's really amazing to me is that the core, key messages have substantially remained the same.

   For example, I recently did a presentation and blog post on bullying.  The biggest change in online bullying in the past few years has been the news media attention.  But what happens, how it happens and options for victims, unfortunately, hasn't changed much.

   As I talk with people about these issues, and research and update my presentation material, I think there are 3 main areas in which things have substantially changed.

1. The rise and expansion of social media.  In the early 2000's, we were talking about things like email, Chat like AOL Instant Messenger (AIM) and web surfing.  Xanga.com was around, but MySpace and Facebook weren't even invented until around 2003!  And, needless to say, there's been an explosion of social media sites with the latest trends favoring pictures and video.  While kids had the ability to share too much information since the beginning, social media sites really drove the norms.
2. Technology.  In particular... mobile technology.  I used to recommend that families keep their computer (singular) in a common place like the family room or kitchen so kids' use could be seen.  While that is still good advice, most families have more than one computer.  And most teens, and many younger kids, carry a powerful computer with them wherever they go... their smartphone.  While we still have options available for monitoring, and good communication is key, portable devices are really a game-changer.
3. Kids get it.  During my Internet Safety talks of the mid-2000's, we used to play a little game.  It was a live demo in which I would bring up a social media site, typically MySpace.  The game was to see how few clicks it would take us to get to some inappropriate content (like kids/teens sharing too much personal information or posting pictures parents would wish they didn't).  When I first started doing this demo it would only take a few clicks.  Then, by around 2008, it took more.  Then I would just save a few URLs of TMI pages.  Then I gave up the game altogether!  It's not that we can't still find inappropriate content, or examples of kids sharing far more than parents might want.  But kids are doing a much better job of protecting their information online.  Of course, kids, teens and young adults - actually digital natives in general - do have different ideas, definition and expectations of privacy compared to their parents!

    One final thought... another thing that has changed is that the oldest digital natives - people who do not know of a time without pervasive digital media and technology - are now having their own kids and showing up at Internet Safety talks!  But some things don't change and their kids still know more about technology!

   What surprises you about changes in our online world over the past decade?  What do you think has changed, or has not changed?

It's That Time of Year - Holiday Spams and Scams

   It's that time of year again folks.  And whatever holiday you may, or may not, celebrate... there's something we're all likely to see.  It's not presents, though maybe there are some for you.  It's not snow, though we'll see that soon enough here in the upper midwest US.  It's malware and holiday scams!

   Unfortunately, it happens every year.  Sometimes it's malicious attachments.  Sometimes it's links to malware to download or phishing sites with forms ready to collect your personal and financial information.

   Here is my 2013 edition of my Top 10 Tips To Avoid Holiday Spams and Scams...

One if by Land, Two if by Prism

   Last week I avoided talking about Prism, the supposed NSA wiretapping issue that has been all over the news.

   However, in the past week I've read or heard 3 different highly insightful analyses and I'd like to comment on them.

   First, on the possible techniques used.  Major data collection organizations including Facebook and Google have denied providing any information to the US Feds as has been alleged.  But the NSA is getting information.