Hannaford Breach: A chance to learn

There is actually some upside to the recently announced multi-million record data beach at grocery chain Hannaford, including the possibility that it was detected a lot quicker than the retail mega-breach at TJ Max (although that assessment may change as more facts come out).

I liked the coverage here at SearchSecurity which addresses the event relative to both the PCI DSS, something my brother and I have been writing about for SearchSecurity, and business continuity, something I am working on at the moment with my good buddy Michael Miora, one of the best guys in the BC business.

There's bound to be be "more later" but in the meantime, feel free to check out Da Cobbs on SearchSecurity (that's Chey, Stephen, and Mike).

LA Here We Come! DNWA to play Laemmle starting April 25

On top of recent critical acclaim comes the news on which Dare Not Walk Alone supporters have been waiting for some time: the beginning of a theatrical run. We are delighted to announce that the film is booked to play at the Laemmle Theatres in Los Angeles in April. Laemmle is a highly respected group of art house cinemas in Southern California and this booking, confirmed last week by our theatrical distribution company, Indican Pictures, is a serious vote of confidence in the film.

In the next few weeks we will be gearing up to make this first theatrical outing as successful as possible. The director, Jeremy Dean, will be in LA a week or so before the opening, talking to as many groups as he can; he will also be on hand for one or more post-screening Q&A sessions. Indican will start putting up the posters April 1. Our goal is to pack the house, not only on opening night, April 25, but also on successive nights, which is what the film needs to secure bookings in additional cities like New York, Chicago, and Dallas.

And that means we will be really happy to see you whatever night of the week you can make it out to see the film (I will be there for at least part of the first week). Details of times and tickets will be posted soon. See you in April!

Let's Do The Time Warp Again: DST disconnect for 3 weeks

Just a reminder that when the clocks go forward an hour this weekend for daylight saving time, the time difference to the rest of the world will enter a period of change. Instead of London being 5 hours ahead of New York, it will be 6 hourse in front, until March 30, when it returns to the regular 5 hours.  We stay in sync until October 26, when the UK and EU fall back an hour. That means  it will be 4 hours between New York and London until the US falls back, on November 2. To recap:

  • Week of 03/02/08 London - New York 5 hours

  • Week of 03/09/08 London - New York 6 hours

  • Week of 03/16/08 London - New York 6 hours

  • Week of 03/23/08 London - New York 6 hours

  • Week of 03/30/08 London - New York 5 hours

  • and so on until

  • Week of 10/26/08 London - New York 4 hours

  • Week of 11/03/08 London - New York 5 hours

  • and so on...


And if you just can't get enough of this topic, check out this site.

Blog Blending Begins: Cobb's blogs coming together at cobbsblog.com

A big welcome to readers joining me from my other blogs! The time has come to put those other blogs on hold and focus my attention on a single blog of record: this one. I am still looking for a way to make the content of the other blogs searchable from this one. And one day I might figure out how to copy the posts over. Until then, here are links to those "other" blogs:

Ugly? No! Bellissima? Si! Giugiaro's gorgeous solar-assisted hybrid

All due respect to Chuck Squatriglia and the editors at Wired but surely it's an aesthetic sin to condemn the Giugiaro Quaranta as ugly (see "Giugiaro Builds the World's Ugliest Prius").

Where's your sense of line and form and function? This is surely a landmark piece of vehicular art, not least because it embodies the electric element of automotive function in a unique new form. Far from cold, it warms the blood with its promise of an eco-friendly future that looks cool and stylish, and about as far from earth-friendly frumpy-ness as you can get.

Sure, there's a place in the retail market for hybrids that look just like other cars while concealing secret energy efficiency. But this design openly embraces efficiency and makes it look deeply appealing (to me at least). I predict it will get pulses racing about the prospect of going green. And that's a beautiful thing.

Why We're Not All Here: 1 in 100 are in there (behind bars)

If you put 100 randomly chosen adult Americans in a room, how many of them would be atheists? Answer = 1.6. So says a new study by Pew.

If you invited 100 randomly chosen adult Americans to meet in a room, how many could there be? Answer = 99. Because 1 out of every 100 adult Americans is in jail right now. So says a new Pew study.

I'm not saying these numbers are related, but they really made me think. Is the 100th American in jail an atheist? Is America holding more prisoners than any country in the world because it is the most Christian of developed nations? (America is 78.4% Christian according to the latest research, higher than Canada, Australia, Germany or the UK, for example.) Consider these numbers:

U.S. population 301 million, 2.3 million prisoners
China  population 1,322 million, 1.5 million prisoners
Russia population 141 million, 890,000 prisoners

The U.S. has 0.764% of its entire population in jail, versus 0.113% in China and 0.631% in Russia. Are we just better at catching criminals than the Chinese? Do we have more criminals to catch than the Russians? Do we execute fewer criminals than Russia and China and humanely opt to incarcerate them instead? Whatever the reason, we are way ahead in the jailing of our citizenry, way ahead of two world powers routinely decried as havens of atheism.

A Powerhouse of a Picture: Willamette Week makes the struggle worthwhile

Anyone who has lived through the epic struggle that is "making a movie" can probably relate to this, as will anyone who has published a novel or launched a new product or opened a new play: the rush of the good review. When a reviewer really 'gets' what you were trying to do, and articulately expresses his or her opinion, well it sort of makes the whole thing worthwhile. Not just because praise is a boost to the ever-hungry ego, but because a good review helps you move closer to your goal of getting your work in front of your target audience. And that's what happened this week to the movie I had the privilege of helping to produce: Dare Not Walk Alone.

The review was not in the New York Times or the San Francisco Chronicle. The reviewer wasn't Roger Ebert (my personal choice as the gold standard for film reviews). Nevertheless, this reviewer , Aaron Mesh, really nailed it, in a very special publication, the Willamette Week (this is the alternative newspaper that serves Portland, Oregon, and just happens to be the only weekly newspaper ever to win the Pulitzer Prize for Investigative Reporting) . Here are some quotes:

"A POWERHOUSE OF A PICTURE"

"MINUTELY ATTUNED TO DISPARITIES OF CLASS AND RACE"

"A TRIUMPH OF OUTRAGE AND EMPATHY"

Please forgive a moment of chest-swelling indulgence as I savor those lines. It's been a long journey--over four years--down a rocky road. When I first met the director, Jeremy Dean, in 2004, he had a vision and a goal, six months of research, and 4 minutes of footage. His main source of funding was tips from waiting tables. Thanks to the efforts of Richard Mergener and the generosity of a small but loyal group of supporters the project was able to keep moving forward.

Along the way, Jeremy provided not only the vision and talent to create the film but also the fortitude and grit to get it out in front of the public (as many creators and inventors know, making the thing is only the start). And each time it seemed like the roadblocks were insurmountable, someone came through for the film. For that, all of us at DNWA are extremely grateful to all of you (you know who you are).

You can read the full Willamette review online on this page, just scroll down the movie list. And if you are anywhere near Portland on Saturday, February 23, please come along to the New Columbia Community Education Center (4625 N. Trenton Street, Portland, 97203). , There will be a free screening of Dare Not Walk Alone at 4:00 p.m. at Bring your family, bring your friends. You can find out more at the movie's blog.

Fab Feb Movie Watching: No faking

Just enjoyed a movie that you might not have come across before: Fakers. This is a small budget Brit movie that is a lot of fun, particularly if you like caper-style romantic comedy. There is a snappy sixties feel to the production and a treat for car fans: the first high speed chase in a Smart Car (as far as I know).

And there's plenty here for fans of Matthew Rhys, since he has the male lead (he's the guy we'll soon see playing Dylan Thomas in love with Keira Knightley in The Edge of Love and also seen in Virgin Territory and Love and Other Disasters). And must not forget the strong and amusing female lead, Kate Ashfield, seen in another, better known 2004 Brit comedy, Shaun of the Dead).

Fakers is distributed by Indican Pictures, an indie outfit that seems to be on the rise. Indican also distributes another under-exposed Brit gem, Pure, which, like Fakers, stars a very attractive British actress (although that is possibly a politically incorrect reference these days). Guess who? Keira Knightley.

(Full Disclosure: I'm the producer of Dare Not Walk Alone which is also distributed by Indican Pictures and yes, they gave me a complimentary copy of the film.)

What Profiteth It Google to Know Your Ip Address

A couple of thoughts in light of Google's divergence from the norm as far as PII is concerned (see previous post On IP and PII: Merely the Location of a Computer? Non!). The debate over what exactly constitutes Personally Identifiable Information is not merely academic or a sidebar for policy wonks, it goes to the heart of how data about people should be handled, stored, shared, protected, etc.

To a certain extent I sympathize with Google in that the best definition of PII is a relative or functional one. Even my name, Stephen Cobb, has limited value in identifying me--it identifies me only in limited circumstances--even though "name" is included in most lists of PII identifiers. The reason for this is the popularity of Stephen as a name for Cobbs (you could say "the commonness of Stephen Cobb as a name," but hey, I'm trying to maintain some PPD here--personal pride and dignity).

My wife's name, Chey Cobb, is clearly going to be PII in most situations. The same is true of my friend Michael Miora (there's only one, AFAIK). But even something like "Stephen Cobb in ZIP Code 32084" does not identify me because there are several people who share these identifiers (I know because my friend Bruce Dufresne, who knows more about the history of the automobile that anyone else I know, knows two Stephen Cobbs and sometimes calls me by mistake when he wants a ride to the car auction). So, the extent to which any piece of data can be considered PII depends upon the context and the aggregate.

As for Google and your IP address, it seems like they may be putting too much store in its value. Consider what happened the last time I was visiting my brother in England and Googled a number of different pieces of hardware, some for my him, some for me. Google was a mess. When I Googled from my hotel room, Google assumed I was in the Netherlands (the hotel's Internet service was provided by a Dutch company).

When I Googled from my brother's office in Surrey, Google really didn't want to tell me about product offerings in the US because I was Googling from a UK IP address. And when I am in America I cannot see the ads served up to UK visitors to his web site, School Sports Action TV, because Google is making assumptions based on my IP address.

In other words, my IP address might be of limited relevance with respect to what I want to see on the Internet. It seems like it would be better to have a "focus" option in Google that I could select to shape my results rather than let them be determined by my IP address. Of course, some folks in marketing are then going to want to know where the people live who select UK as their focus. My point is that my IP address does not reliably provide that data. So Google might want to think about how hard it wants to defend its collection and retention of that data.

Facebook Stickiness or Sticky Mess?

Sometimes I read something in the newspaper that makes me feel better, not because it is good news, but because it lets me know I am "not the only one" or "not imagining things." So it was with a recent New York Times article about Facebook focusing on the difficulty people have had deleting their data from Facebooks's computers.

The article plays on the term "stickiness" as in "the amount of time users spend at a web site over a period of time." This can be a major factor in selling ad space on a web site or otherwise monetizing it. But the sticky-ness described in the article is the problem of closing a Facebook account, which basically you cannot do. I found this out when I realized I had two Facebook accounts. Not sure how that happened (but it would seem to be a flaw in the Facebook design that it could happen).

I figured I would delete one account. I could not. I could close it down, somewhat, but the stuff, the data that was associated with it, remains in the Facebook server farm, ostensibly so I can revive that account at some point in the future. I assumed this difficulty in deleting an account was driven by security concerns, as in: make it hard for people to close accounts they are not unauthorized to close, i.e. one's belonging to other people. Apparently that might not be the case. Could it be they want to keep mining that data forever? Here are a few points to note, from the Times article:

  • Facebook’s terms of use state that “you may remove your user content from the site at any time,” but also that “you acknowledge that the company may retain archived copies of your user content.”

  • Its privacy policy says that after someone deactivates an account, “removed information may persist in backup copies for a reasonable period of time.”

  • Facebook’s Web site does not inform departing users that they must delete information from their account in order to close it fully—meaning that they may unwittingly leave anything from e-mail addresses to credit card numbers sitting on Facebook servers.


Seems to me Facebook is still growing up in terms of understanding data privacy issues. After all, the retention policy in the terms of use is pretty much in direct contravention of the basic principles of data privacy.