Robert Mullins

Confessions of a census thug

2010-09-03T13:02:00.000-07:00

I have taken my Robert Mullins blog out of mothballs after 10 months to post this item on my experience in May and June as an enumerator for the U.S. Census Bureau. I hope you enjoy it. the Census Bureau has rules that employees who blog about their experience can't make any money out of it so, please, don't send me any. Robert

When I informed my family and friends that I'd taken a job as an enumerator for the U.S. Census Bureau, one of my nieces replied, "Oh, so you're a census thug!" and it gave me a chuckle.
Every 10 years, dating back to 1790, the U.S. conducts a census of the population and, every 10 years, a certain percentage of people don't mail back the form because they lost it, they think it's a government conspiracy to spy on them or it just isn't a priority. So every 10 years, the government hires an army of people like me to go door-to-door to the laggards and try to get them to complete the census form.
This year about 600,000 of us "census thugs" fanned out to 48 million households nationwide from which a form was not received to (gently) lean on them. Since forms were sent to about 120 million addresses, that comes out to a delinquency rate of 40 percent.
My experience during eight weeks in May and June taught me that more than 90 percent of people are cooperative and welcomed me into their homes to complete the form, while the rest remained suspicious, even hostile, to the entire undertaking.
The Census Bureau is very strict about confidentiality with rules prohibiting disclosure of personally identifiable information about citizens. I'm not supposed to disclose the specific location where I worked as an enumerator. All I'll tell you is that my beat was in the eastern exurbs of San Francisco.
In my area, a precinct if you will, 19 people were deployed as enumerators and like me, most of them were underemployed. I'm a reporter covering the tech industry who works freelance, not by design but by circumstance; another enumerator had lost his auto parts business; another had quit her job and moved out-of-state with her husband, only to divorce him and return to find her job gone.
After a few weeks, we began sharing stories with each other of the people we encountered. One enumerator said one respondent called the local police reporting a trespasser. The enumerator showed his credentials and two officers stood behind him as he completed the survey.
That was a better outcome than the May 21 case in Yuba City, Calif., where an enumerator was greeted at the door by a man brandishing a handgun. She quickly retreated, called her supervisor and then police. When police arrived they were confronted by not just the man with a handgun, but a 67-year-old woman with a shotgun. After failing to heed officers' repeated demands that she put down the shotgun, police shot and killed the woman.
The Washington Post reported in late May 113 attacks on census workers nationwide just that month, when enumerators were busiest.
Although there were a few veiled threats of violence made to enumerators in my group, most of the time people were just being jerks.
One angry-looking respondent flat out refused to answer my questions. "I'm not giving any information to the f-ing government," he said, before closing the door in my face. We, of course, have to remain professional and polite, but part of me wanted to say, "Okay, pal. But if you think you see any black helicopters flying over your house, they're ours." (Full disclosure: the Census Bureau does not have black helicopters.)

A census form left for me, crumpled
and under the sprinklers (and still valid).

Then there are those who think they know the law better than the Census Bureau. "You know what 'census' means? It means to enumerate, to count," said one who would only tell me that, count 'em, two people lived at his address. That may be the dictionary definition of census but it's not the legal one. The governing authority of the Census Bureau is Title 13 of the U.S. Code, which, among other things, determines what questions can be asked and should be answered to complete a census form.
But there's a certain number of respondents who choose to be, well, dicks. Given that census statistics are used, among other reasons, to allocate federal anti-poverty funds, I found it ironic that Mr. You Only Get to Count People had a sign on his doorbell of a rendering of a fish with the word "Jesus" written inside it. Jesus as in "love thy neighbor as thy self" Jesus and help the poor, feed the hungry, heal the sick, clothe the needy Jesus. Yeah, that Jesus. But I made a judgment call not to point out his hypocrisy.
Other enumerators who visited mobile home parks or apartment complexes reported resistance from managers to providing contact information about residents. It turns out there's a section in Title 13 that states that such obstruction is punishable by up to a $500 fine. You can refuse to cooperate with the census, but you can't deny someone else their right to be counted.
Our crew leader shared this information with us via e-mail to which I replied, "If that doesn't work, tell them your partner is Jack Bauer."

Jack Bauer, Census Enumerator

The hero of the TV series "24" would be an effective enumerator, I felt. "DAMMIT! WHO WAS LIVING IN THIS HOUSEHOLD ON APRIL 1, 2010? GIVE ME THEIR NAMES!" Can you just see it? We'd get that response rate up to 100 percent in no time.
Still, in other cases, I learned that people who I felt were being obstructionist had something else going on in their lives that for them meant filling out a census form wasn't a priority. "We have sickness in our house," bellowed one.
In another case, there was a home I'd visited several times, leaving notes asking for a call back, but receiving none. Eventually, I found a phone number for the house and a woman finally answered. "How are you?" I asked. "I'm crying, can't you tell?" she replied before hanging up. While people who fail to respond to requests for an interview may be rude, inconsiderate or hostile, the fact is you never really know what's going on behind that door on which you are knocking.
While a few of the refusals came from people who were just being obstinate for its own sake, some of the other objections likely reflected the times. After reading one reluctant respondent the boilerplate language about how his census answers would be kept confidential, he said, "Well, I've heard that before," and refused to answer any more questions. To be sure, the phrase "identity theft" was not in the national vocabulary in 2000, 1990, 1980 or before that, but it is now.
But we enumerators were all acting in good faith. As a technology reporter, I've done a few stories about network security and it's amazing how many breaches have been reported at banks, ATMs, or of medical or credit card records and the like. But I've never heard of a breach of confidential information involving the Census Bureau.
There were heartwarming moments. At one address, I learned there were 11 people of three generations living under one roof. The grandmother laughed when I told her I had to go back to my car to get extra forms.
Then there was the elderly couple, both 75, alone in their house. The wife didn't speak English but the husband spoke it well enough to complete the form. He was struggling to walk with a cane, telling me he'd fallen down the day before and had a doctor's appointment the next day. I thanked them warmly for their cooperation. A few minutes later I was back in my car, doing some paperwork, when I see through my windshield the old man, struggling down the driveway on his cane, coming to bring me a chilled bottled water from his refrigerator.
Those are the kinds of people who deserve to be counted as members of their community.

Posts on handset makers, carriers and Oracle

2009-11-02T10:29:00.000-08:00

I wrote a number of earnings stories during this period on AT&T, Microsoft, Motorola and Sprint.

But I also got a couple of stories out of covering a Sprint developers' conference in Santa Clara:

Sprint touts 4G possibilities at developer conference

Internet-ready Ford F-150 at Sprint conference

Sprint removes barriers to Google Voice, Skype, Vonage

I also followed the continuing opposition to the Oracle acquisition of Sun when a deal critic came to Silicon Valley from Europe.

Oracle-Sun critic doubts Oracle's 'promises' to support MySQL

I ended the week receiving my demo of the Samsung Moment from Sprint, which I played with over the weekend and posted my review of Nov. 1, the day it went on sale:

Samsung's Moment has arrived

Samsung Moment from Sprint

A couple of days I posted two stories in one day, earning me the number 1 position as top San Jose Examiner for having the most page views.

Persuasive Marketing

2009-11-02T10:21:00.000-08:00

I've been blogging the last few months for Persuasive Marketing, a blog site from the firm Attain Marketing, based in North Carolina. Lorraine Kauffman-Hall, who once worked PR for a tech company I covered in Silicon Valley, is now with Attain and asked me to write about PR from the media's perspective. Here are some of the posts:

Top Ten things PR people show never say to the media (Part 1):

Top Ten things PR people should never say to the media (Part 2):

Ignore Facebook at your peril:

Twitter me this:

Posts the week of Oct. 19

2009-10-21T09:37:00.000-07:00

Apple produces strong earnings on iPhone, Mac sales

Apple freshens Mac Book, puts big screens on iMac

At least Sun and Oracle logos have merged,
in this image on a staircase at Oracle OpenWorld
this month in San Francisco.

Opposition to Oracle-Sun deal grows, Sun layoffs

Gov. Schwarzenegger at Oracle gathering

2009-10-16T12:47:00.000-07:00

California Gov. Arnold Schwarzenegger made a surprise appearance at Oracle OpenWorld in San Francisco Oct. 14 to "pump you up," he told an audience of technology geeks.

Schwarzenegger endorses Oracle-Sun Deal

Busy day Monday with Sidekick debacle

2009-10-16T12:36:00.000-07:00

Monday Oct. 12 was a busy day as I tried to keep up with changing developments in the story of T-Mobile dealing with irate customers because they lost the data backup for their Sidekick smartphones. It seems Microsoft and Danger (the latter, the maker of the Sidekick that was acquired by Microsoft in 2008) suffered a server malfunction that wiped out nearly all the data of users it was supposed to be storing.

T-Mobile store in Antioch, Calif.

Here's the initial report on it, updated once with more information.

And here's the second story about how T-Mobile said the situation had been resolved.

My report on AT&T Prepaid phone plan

2009-10-10T10:29:00.000-07:00

AT&T is offering a new prepaid calling plan, one of many carriers pushing prepaid plans as an alternative to post-paid plans where the subscriber is tied to a contract for two years.

On AT&T, Apple, BlackBerry and other gadget news

2009-10-08T10:58:00.000-07:00

A couple recent posts of mine on Examiner.com:

AT&T reverses course on VoIP on iPhone; an analyst doubts its stated motives:

AT&T allows wider use of Skype; urges FCC light touch

Apple quits U.S. Chamber of Commerce over global warming skepticism

Apple takes a stand on climate change

Good news for BlackBerry users

BlackBerry to support Adobe Flash

Palm dilemma: how to price Pixi when Pre prices falling

Prices falling for Palm Pre

Ellison on pending acquisition of Sun

2009-09-24T14:35:00.000-07:00

Tech journalists and others listened with interest when Oracle Corp. CEO Larry Ellison spoke about the pending acquisition of Sun Microsystems during a presentation at the Churchill Club Monday Sept. 21 in San Jose.

Recent Examiner posts

2009-09-18T08:33:00.001-07:00

I have been drawn to other assignments that have kept me from posting as often as I would have wanted to on Examiner.com, but here are a few of my latest reports:

Gadget ideas for the 'Hybrid Mom'
Sept. 17
Linux makes headway in netbooks, smartphones
Aug. 13

Plantronics Voyager 975 hits the market
Aug. 20

Symark acquires BeyondTrust in security access space
Sept. 12

Open Table and other mobile apps news
Sept. 14

Busy Tuesday

2009-08-08T10:46:00.000-07:00

Tuesday Aug. 4 was a busy day for me as an Examiner. First, I covered a Churchill Club event in Mountain View featuring Aneesh Chopra, President Obama's chief technology officer:

Obama's CTO seeks ties with Silicon Valley

Then I drove up to San Francisco to cover a launch party for a gadgets Web site:

Gadget fans turn out for gadget site launch party

I also kept up on events related to the release of the Current TV journalists imprisoned in North Korea. I had written about a vigil held for them in San Francisco in June:

Current TV journalists released by North Korea

Good and Bad News About Apple

2009-08-02T22:50:00.000-07:00

The good news: Anticipation is building that Apple will introduce a tablet computer to the market this fall. The story: "Apple Tapplet, Anyone?"
The bad news: Apple is telling developers they, not Apple, should pay back customers whose iPhone applications were banished from Apple's App Store. One of the developers relates an absurd and frustrating conversation with an Apple representative from whom he was trying to get answers as to why his app was banned. The story: "Apple, the unbenevolent dictator."

Apple and AT&T irk fans of iPhone and Google Voice

2009-08-01T15:48:00.000-07:00

I'd been behind the curve on following this flap over the last week, busy with other assignments. But now the FCC is getting involved in the decision by Apple to ban the VoIP application Google Voice from its App Store. It seems using your iPhone to make calls over a VoIP provider conflicts with the financial interests of AT&T, which is the exclusive carrier in the U.S. for the iPhone. Some say this is anti-competitive and that people Hope FCC can rein in Apple, AT&T.

Line forms outside the Apple store in
Santa Clara, Calif., the day the
iPhone 3GS goes on sale

A little off the beaten path but not by much. This post, titled "Irish entrepreneurs search for Silicon Valley pot of gold," is about a trade mission to Silicon Valley by some Irish entrepreneurs and economic development advocates. One of them is a guy whose gadget allows people to buy songs to play on their cell or smart-phone via text message.

More on netbooks, Symbian

2009-07-23T11:26:00.000-07:00

I've been following the netbook trend of smaller, cheaper laptop computers, including AT&T's adding netbook models to its offering. I snapped this photo of an AT&T employee demonstrating the netbooks at the store in Santa Clara.

Also this week I attended OSCON, the Open Source Convention, in San Jose. One interesting session was a tutorial on Symbian, the mobile OS that is little known in the US but the market share leader everywhere else in the world. I was fortunate to run into Laura Merling (see below) of the Symbian Foundation, whom I'd interviewed before when I worked for SD Times and IDG News Service.

My latest Examiner.com posts

2009-07-17T10:30:00.000-07:00

Thursday I attended the MobileBeat 2009 conference in San Francisco and wrote about Palm releasing its software development kit for creating applications to run on its Pre smartphone.
There were a number of other interesting panels including this one pictured below in which an entrepreneur (far left) pitches his business idea to a panel of investors and other experts. There were several entrepreneurs who spoke. The panel then voted on who had the best idea. It was hosted by Natali Del Conte (second from left) of Cnet and CBS.
The day before MobileBeat, I wrote about how Apple, as expected, upgraded iTunes in a way that disabled the sync functionality on Palm Pres running iTunes. Asked about it at MobileBeat, Palm's Michael Abbot (pictured here) could only reiterate the company line that Apple is only hurting its own iTunes users by preventing syncing on Pre, but that there are workarounds to continue to add songs to your iTunes library on Pre.
Also, I took a look at SmartSwipe, a credit card reader that someone can plug into their computer to make purchases online. Secure, for sure, but a potential enabler of binge shopping.

Netbook or Notebook

2009-07-13T09:00:00.000-07:00

I wrote this post the other day comparing netbooks and notebooks...

Netbook or Notebook?

HP Mini 1000

...and this item about the myTouch 3G going on sale...

T-Mobile takes orders for myTouch 3G

HTC myTouch 3G

Solar-powered cell phone recharger

2009-07-07T23:24:00.000-07:00

Check out this post titled: "Inventor creates solar-powered charger from an Altoids tin."

New iPhone spurs market for refurbished phones

2009-07-05T11:08:00.000-07:00

Here's another Examiner post I wrote about how the popularity of the new iPhone has given a boost to the market for refurbished iPhones and other smartphones. It includes mention of a friend of mine, Tara Sims (right, with me in photo below), who bought the 3GS and didn't just throw her BlackBerry in the back of a drawer, but gave it to charity.
Elsewhere, at least one company pays people for their old iPhones and refurbishes them. RapidRepair, in Michigan, was flooded with requests from new 3GS owners to buy their first and second generation iPhones from them for up to $200.

Latest posts to Examiner.com

2009-07-02T10:22:00.000-07:00

It's been another busy week for me at Examiner.com.

I went off my gadgets beat for this story on Two Journalists Held in North Korea (right) as I attended a vigil in their honor in San Francisco. I added a slide show of photos I took at the event.

Then I wrote about The Wonderful World of (Gadget) Color about how product designers are using bright colors to distinguish their new gadgets from the basic and boring black and grey of previous models.

Back on the Bluetooth beat, after a couple of stories about Santa Cruz-based Plantronics, I got to try out the new Jawbone Prime (left) from competitor Aliph for a few days.

As part of my continuing coverage of new smartphone introductions, I revisited the Palm Pre for a story on how its sales have exceeded expectations.

AT&T Mobility made some news this week by announcing it's going to start selling netbooks to small business customers who can use the carrier's wireless broadband service.

And lastly, I noted the passing of Michael Jackson in a post noting how social media, on gadgets like smartphones and laptops, spread the word of his death.

Busy day on the tech beat

2009-06-23T15:52:00.000-07:00

Monday June 22 was a busy day for me on the tech beat with three posts:

Here's a post about a guy who takes brand new tech devices, like the iPhone 3GS, and tears them apart to see what's inside. "OMG! My new iPhone! In pieces!"

For the first time since he went on medical leave in January, Steve Jobs was quoted in an Apple news release, this time about opening weekend box office for the iPhone 3GS. "Steve Jobs back on the job?"

Kudos are in order to the people at the New York Times with a timely report about the culture of secrecy at Apple.

Also, Monday, another entrant in the smartphone wars: "T-Mobile's myTouch 3G smartphone revealed."

My coverage of the iPhone 3G S launch

2009-06-20T13:26:00.000-07:00

Like a lot of other tech journalists, I was drawn Friday morning to my friendly local neighborhood Apple store to witness the launch of the new iPhone 3G S. Here's the story I posted on Examiner.com: "New Apple iPhone goes on sale."

An Apple employee demos the iPhone 3G S
to customers at Apple's Valley Fair Mall Store.

Also, word came out today in the Wall Street Journal that Apple CEO Steve Jobs had a liver transplant. I can't link to the story because WSJ is password-protected, but here's the San Jose Mercury News report on the WSJ story.

My continuing coverage of Pre v. iPhone

2009-06-16T19:08:00.000-07:00

In my continuing coverage of the Palm Pre and Apple iPhone, I wrote a story for ITWorld.com titled Palm Pre playing catch-up in apps race.

It's hard out there for an iPhoner

2009-06-15T13:20:00.000-07:00

A report on some problems, more like irritants, for iPhone fans.
From Examiner.com.

And another Examiner post, this one on one of the cool apps to be available on the Apple iPhone 3.0 OS and the coming iPhone 3G S: "Find My iPhone."

Apple iPhone 3G S, the S is for SPEED!

2009-06-10T11:51:00.000-07:00

Just two days after the Pre launch, Apple introduced the new iPhone 3G S. What's worse, for Palm, is Apple lowered the price of the existing Palm 3G to $99, half of what the Pre goes for after rebate. But they're on different carriers. I wrote about the new iPhone for ITWorld.com and then wrote a separate post on Examiner.com about one of the nifty apps on iPhone, Find My iPhone.

I've also written additional stories for ITWorld, including this from JavaOne about an RFID company called Touchatag and another JavaOne story about the proliferation of app stores.

Palm Pre launch

2009-06-07T12:21:00.000-07:00

I've been following with interest the launch of the Palm Pre smartphone.

In reverse chronological order, here's my post on a Pre launch party.

Sprint launches Palm Pre posted June 5

Next is the most-read of my Examiner.com posts, with 22 comments, a personal best!

Controversy about Sprint's Palm Pre plans posted May 22.

And an early preview.

From Palm, a Pre preview posted May 21.

JavaOne

2009-06-07T12:17:00.000-07:00

I managed to get a few stories for Examiner.com out of my covering Sun Microsystems' JavaOne 2009 conference at the Moscone Center in San Francisco.

Sun to open Java Store for selling apps posted June 2.

Sony Ericsson needs apps developers posted June 3.

I wrote two other stories for IT World.

Examiner.com Postings

2009-06-07T12:08:00.000-07:00

I've been writing a lot more posts for Examiner.com as the San Jose Gadget Examiner.
Here are a few of them:

Garmin's new GPS handhelds posted May 7

Kindle DX launch posted May 6

Selling technology to women fraught with peril posted May 16

Launch of Voyager Pro Bluetooth from Plantronics posted April 27

You can read all of my Examiner posts on my home page.

Robert reporting from the RSA Conference

2009-04-25T13:16:00.000-07:00

I just completed a freelance assignment covering the RSA Conference 2009 for RSA.

I wrote 17 stories that were posted on the conference Web site during the week long event April 20-24. I interviewed keynoters and wrote stories on several of the breakout sessions. Here are just a few:

"Lax security can invite lawsuits" is about a panel discussion, moderated by CNN Legal Analyst Jeffrey Toobin, about legal issues related to e-discovery and company liability for data breaches.

"Innovation Sandbox winner announced" is about a competition among early-stage tech security companies who presented their innovations and business plans to a panel of judges.

"Social networks present new risks for malware, ID theft, etc." is about how people let down their guard when visiting "friends" on Facebook, MySpace, Twitter, etc.

"Tackling Cyber Security Challenges Today" was a very interesting panel about how the U.S. government, including the National Security Agency, Department of Defense and Department of Homeland Security, are trying to protect cyberspace from attack.

"The 'MythBusters' stars next challenge: Is code unhackable?" Is about the Discovery Channel show whose co-hosts gave a keynote on the last day of RSA Conference 2009.

New Examiner post

2009-04-15T09:07:00.000-07:00

I posted another blog item on Examiner.com about a new Bluetooth headset product coming from Plantronics.
If you go to this page and bookmark it, you will see all my Examiner posts on one page as I make them.

My new role as an "Examiner"

2009-04-06T15:21:00.000-07:00

I finally started posting articles in the last week for Examiner.com, the blogging site for the San Francisco Examiner newspaper. The paper has recruited an army of several hundred bloggers, mostly in the Bay Area but also in some other U.S. cities, to write about everything under the sun. We make a pittance, but it could result in some valuable exposure and help build a porfolio of articles.
Here are the first four articles I wrote:

Plantronics takes 'one giant leap' for managing multimedia audio
Savi Office introduction. March 31

Now you'll have no excuse to forget the milk
Shopping cart-mounted computer. March 31

Nintendo's 'Virtual Boy' undergoes autopsy at ESC
Failed product, April 1

Wireless networks can help around the house
Mesh networks, April 6

Be sure to click on the link "Add Robert to Favorite Examiners" and come back often.

Venture Capital Forecast 2009

2009-03-17T15:59:00.000-07:00

I learned about the state of the venture capital industry at another Churchill Club forum, this one in Palo Alto. It featured three VCs and an angel investor Reid Hoffman, CEO of LinkedIn. The story I posted on Suite101.com is titled "Top 20 VC Firms Should be Okay."

Future of Newspapers

2009-03-13T11:53:00.000-07:00

I accepted a recent invitation to attend a meeting of the Public Relations Society of America (PRSA), Silicon Valley Chapter. The program, held at Microsoft's campus in Mountain View, featured two technology reporters and an editor from the San Francisco bureau of The New York Times. They spoke about how they work with PR people, like the 50 or so at the event and how they are adapting to the new media landscape of distributing news online, on blogs and even via Twitter. I wrote about the event for Suite101.com in an article titled: "Newspapers Have to Adapt or Die."

When the housing crisis gets literally too close to home

2009-02-22T15:23:00.000-08:00

I’d seen stories on TV news about how people who’d lost their homes just packed up what they could into their cars, after which crews would come and clear out everything else they’d left behind. This Sunday I saw it happen in my own neighborhood.

A bank-owned home being "trashed-out" in Santa Clara.

I was walking my dog in a light afternoon rain when I came upon this scene: a “Bank Owned” real estate sign planted in front of a modest three-bedroom tan stucco-walled home in the 500 block of Chapman Court, just off The Alameda, in Santa Clara. Parked across the street was a dumpster, filled with a mattress, armchairs, shelves and other possessions that had made that house a home. Shuttling back and forth between the house and the dumpster were three men working in what is one of the fastest-growing jobs in the country: clearing out foreclosed homes.

The crew leader, José, said he works for a Las Vegas company that, despite being overwhelmed with work clearing out homes in that distressed market, dispatched him here where there is also plenty of work. Since he arrived in the San Jose area seven days ago, José said he’s not had a day off and averages 16 of these house-clearing projects a day.

Banks and mortgage lenders hire such companies to clear out foreclosed homes and clean them up so they can be put back on the market as quickly as possible, so the lender can make some of their money back.

A child's school photo left behind

The onetime owner of the Chapman Court house did come back after moving out to retrieve some valuable items, José said, such as TV sets or computers, and what was left behind was rightly headed to the landfill or at best a rummage sale. But I’ve seen cases in which seemingly everything was left behind. A report aired on a recent "NBC Nightly News" but I'm having trouble including the link. But here's another report from PBS’s “The News Hour with Jim Lehrer,” from Oct. 2008 on clearing out abandoned homes.

In the NBC report, golf clubs, sofas, paintings and some personal items are taken away by “trash-out companies” and while some items are set aside to be given to charities, many were simply thrown out. In the PBS report, residents left behind newer TVs, computers, important documents like a birth certificate and other perfectly good items.

A dumpster of what had made this house a home

It’s bad enough that people lose their homes. But I find it just heartbreaking that people find themselves in such desperate straits that they have neither the time nor the resources to try to save some of their belongings in order to furnish their next home, even if it’s only going to be a rental.

Worst of Recession Lies Ahead

2009-02-21T11:27:00.000-08:00

I attended a frankly chilling discussion Wednesday on the economy at an event sponsored by the Churchill Club, a public affairs forum. Two Silicon Valley executives, a venture capitalist and a well-known law professor presented a sobering forecast about how the economy is going to fall further before picking back up again. I wrote about the event in an article titled Worst of Recession Lies Ahead, which is posted on Suite101.com. One of the panelists, Lisa Lambert of Intel Capital, pointed out that it has been during some of the worst economic downturns that some of the biggest innovations have come to market. Such Historical Perspective can provide reason for optimism in these bleak times.

A burst of creative energy on Suite101.com

2009-02-13T19:33:00.000-08:00

I got ambitious the other day and pounded out TWO Suite101.com posts. The first was on SaaS...software-as-a-service...the new distribution model for software in which enterprises access applications online rather than installing it on their own network. The story "SaaS Growth Depends on Integration" looks at how SaaS applications have to work well together with on-premise apps.

The other story was on cars, specifically plug-in hybrid electric cars. I've written a couple of stories of gas-electric hybrids, but this was my first on plug-ins. The story, "Electric Cars Will Need a Fill-up, too," looks at two different business models for developing electric car charging stations.

Robert the car guy

2009-02-04T11:51:00.000-08:00

Besides writing about technology, I've also been blogging of late on one of my favorite subjects: I'm a car guy. I write for a blog site called Suite101.com. It's called 101 because a lot of the posts are how-to in nature, like an introductory college course, 101.
Here's one I posted recently on the Honda Insight, an upcoming challenger to the Toyota Prius among hybrid cars.

I also wrote this preview of the Ford Fusion Hybrid due in the spring.

Earlier I wrote about other gas-sipping cars that aren't hybrids, such as the Honda Fit.
My neighbor just bought one of these. I'm not sure whether this dilutes my "brand" as a tech journalist or just shows my versatility. In the stories, I do write about hybrid technology so I think it covers both. And according to sage career advice: "Do what you love and the money will follow."
(Photos are courtesy of Honda and Ford.)

E-discovery versus Web 2.0

2009-01-30T14:07:00.000-08:00

I had a new blog item posted this week on Suite101.com about the concerns companies have that communications on new technology like texting, Facebook and even Twitter could be subject to e-discovery laws. Check it out.

GigaOM Post

2009-01-15T10:19:00.000-08:00

I've had the opportunity to also write for the popular technology industry site GigaOm. One of its properties, Earth2Tech, is devoted to green tech news. It posted Jan. 14 my report, "Solar's Dirty Side is Being Ignored, Report Says," about an environmental group's study of hazards related to solar panel manufacturing. It's a followup to a story I posted on Earth2Tech earlier, previewing the upcoming report, "Cadmium: The Dark Side of Thin Film?"
It's clear that green technology is an emerging field that offers new opportunities for me as a journalist.

IDG News/Network World

2009-01-07T15:56:00.000-08:00

From August 2006 to November 2007, I was a writer for IDG News Service, the wire service for multiple IDG publications, and for Network World, one of the IDG titles. Here are a few samples of my work.

Before I was hired, most of Network World's reporters were based in Boston or scattered elsewhere in the U.S. I offered the advantage of being based in Silicon Valley. My editor said this was the type of story they were looking for from a Silicon Valley-based reporter: "Unauthorized iPhone Apps Market Fluorishes" Sept. 26, 2007

Network World has been active in making their Web site more dynamic, with multimedia features such as slide-shows. I covered a conference at the Computer History Museum in Mountain View, Calif. My story, "Deconstructing the PC revolution ," was accompanied by a slide show of photos I took of computers that are literally museum pieces! Nov. 5, 2007

This is a major project story I wrote about an IT upgrade for the Bay Area Rapid Transit (BART) system in San Francisco: "Process makeover keeps BART on track" Oct. 12, 2007

One of my main beats at Network World, as well as at IDGNS, was storage technology. This article explored the problem many enterprises experienced of buying too much storage because much of the capacity was set aside for various groups but little used. "When in doubt, buy more storage" April 23, 2007

At IDG News, I was the lead reporter on coverage of the HP pretexting scandal. My experience included being prevented by handlers from trying to interview CEO Mark Hurd about the scandal at an HP conference in Houston. Some of the other stories:

"HP CEO calls pretexting probe a 'rogue' investigation" Sept. 26, 2006

"Dunn to 'set the record straight' in HP case" Sept. 21, 2006

I also covered a federal court hearing over a lawsuit against telecoms for cooperating with the Bush administration's warrantless wiretapping program. This analysis column was called "Reporter's Notebook: NSA suit like Alice's Wonderland" Aug. 16, 2007
To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302

Robert can take photos, too

2009-01-06T14:12:00.000-08:00

This photo of Neil Young making a cameo appearance

at JavaOne made the front page of Software Development Times.
Photo credit: Robert Mullins

As a senior editor for Software Development Times, I, of my own volition, used my personal camera to take photos. Invariably, on production day for each of the print issues of SD Times, someone form the graphics department would e-mail me asking for a headshot of whomever was featured in one of my articles. I'd have to scramble and call the PR people at a company to send me a headshot, which may as well have been the guy's driver's license photo. Finally, I decided to take my own photos, when possible. Here are some photos and some related stories:

Sun Microsystems CEO Jonathan Schwartz

Showfloor at JavaOne 2008

Ian Murdock, VP of Developer and
Community Marketing, Sun Microsystems
Reuven Cohen co-hosts "unconference" on
cloud computing in San Francisco in May 2008

Participants at the "Cloud Camp" in San Francisco
line up to suggest breakout sessions for their
"unconference" on cloud computing in May 2008
The Firefox mascot greets visitors to Mozilla's
headquarters for a launch event for the
Firefox 3 browser in June 2008

The crowd at Google I/O Conf.

Moscone Center, San Francisco, May 2008

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302

Coverage of software development

2009-01-05T16:23:00.000-08:00

I had the opportunity to learn the ins and outs of the software development field while writing for Software Development Times in 2008. I had written a little bit about software development but my knowledge was an inch deep and a mile wide compared to the in-depth knowledge readers of SDTimes expected. But in a few months I was able to learn the inside scoop in stories such as these:

Java the Bloat
June 15, 2008

Sun-MySQL progress report
July 17, 2008

'We don't know what we should be teaching:' software programming for multicore
April 14, 2008

Dissident Icahn added to Yahoo board
Aug. 4, 2008

Android apps draw crowd at developer conference
May 30, 2008

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Blog for GigaOM, too

2009-01-05T16:15:00.000-08:00

I've also had the opportunity to blog for GigaOM, the site run by veteran Silicon Valley technology writer Om Malik. After being introduced to one of their editors by a good friend, I submitted a post I wrote based on information I had obtained about a pending report on environmental hazards related to solar energy. Cadmium: The Dark Side of Thin-Film? was posted Sept. 25, 2008 on the GigaOM-related site Earth2Tech. The article generated considerable comment.

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

I can blog, too, Pt. 1

2009-01-05T15:26:00.000-08:00

I have extensive blogging experience, having been senior editor of a blog for my extended family since 2006. That's just for personal use, as is another blog titled "Mullico Musings", which offers my take on politics, current events and other personal interests. But I've also posted on commercial blogs, such as Suite101.com. It posts blogs on a variety of topics, mostly "how-to" type articles. I've written a few combining my personal interest in cars with my knowledge of technology. Here's one recently posted on hybrid cars:
Midsized hybrids segment grows:

On a related subject, I also wrote about Shopping for green cars besides Prius or Escape

And now for something completely different, Suite101 has blog pages devoted to cloud computing, to which I contributed this article Dec. 11, 2008: Cloud Computing Not the Answer for Every Business

As you can tell, I am a very versatile writer with an ability to write with authority on a wide range of topics. Besides covering the tech industry in Silicon Valley, I've also been a business reporter covering multiple industries. I can pick up on new beats quickly.
On a more practical matter, I am able to write with the distinctive "voice" of a blogger, which is different from the third-person observer voice of the traditional journalist. Also, I have learned how to maximize the opportunity to draw readers to a blog with the right amount of links and the highlighting of keywords searchers will be drawn to.
Lastly, I can also blog with a sense of humor, a la "The Onion," as in this post on the speculation about the health of Apple CEO Steve Jobs, rumors that were dispelled with a company pronouncement Jan. 5 that he is being treated for a "hormone imbalance."

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Robert Mullins coverage of network security, Pt. 4

2009-01-05T15:16:00.000-08:00

I also had the opportunity to write for SearchSecurity.com for the story FACTA's red flags of identity theft, which was posted Feb. 26, 2008:

Later this year, new Federal Trade Commission (FTC) rules go into effect requiring businesses to recognize the "red flags" that tell them someone may be committing fraud.

Businesses that maintain personal financial information on customers -- from banks to auto dealers -- must have systems in place to spot red flags and intervene to stop a possible identity theft.

"If someone were to apply for credit and they put down their date of birth and then a Social Security number that does not correlate to the date of birth, that would be a red flag," said Paul Metrey, director of regulatory affairs for the National Auto Dealers Association (NADA), which hosts data security workshops for dealers.

Red flags

The following are examples of red flags, according to the FTC:

The majority of available credit on a card is used for cash advances or merchandise that is easily convertible to cash, such as jewelry;

A noticeable change in electronic fund transfer patterns on a deposit account;

Purchases in two distant cities on the same day;

Identification documents provided to open an account appear to have been altered or forged;

Customer can't answer challenge questions like identifying their mother's maiden name.

The Red Flag rules from the Federal Trade Commission (FTC), which take effect Nov. 1, 2008, are a follow-up to the Fair and Accurate Credit Transactions Act (FACTA) enacted in 2003. FACTA requires businesses to have systems in place to secure the personal financial information of customers and to securely dispose of that information when it's no longer needed.

Besides auto dealers, businesses subject to FACTA include debt collectors, mortgage brokers and even someone who obtains a credit report on a prospective nanny, according to the FTC.

"Whether someone hiring a nanny is aware [of FACTA], I don't think there are, obviously. But I think financial institutions are aware of it and they have to be," said Mary Monahan, senior analyst with Javelin Strategy & Research, which focuses on the financial services industry.

Keeping dealerships secure

Car dealers regularly work with finance companies, but there is no one data security plan for all of them, said NADA's Metrey. "The procedures you adopt should be appropriately tailored to the size and complexity of your operation."

For a small dealer, selling just a few cars per month, security could be as simple as advising the finance manager not to leave contracts on their desk when they leave the office.

For a large dealer group with multiple car make franchises, though, best practices include password-protected access to servers only for people whose job descriptions entitle them to access. A service department manager can access a customer's vehicle maintenance records, but not their finance records. Servers should be in a secure, climate-controlled room and not accessible via the Internet, NADA advises in a guide to dealers.

Don't reinvent the wheel

Privacy regulations have been imposed on debt collectors for years so new rules such as FACTA aren't all that new to them, said Leslie Bender, an attorney specializing in privacy laws who represents a debt collection industry group.

Debt collectors, who obtain personal financial records of debtors to collect money on behalf of client creditors, have been subject to the Fair Debt Collection Practices Act for about 30 years. They and vendors of computers, firewalls or document shredding services, are "light years ahead" of other industries on their security policies, said Bender.

"Debt collectors are attuned to protecting consumer data and don't just pitch it into the dumpster," she said.

But besides securing and properly disposing of records, financial institutions now also have to be further diligent under the Red Flag rules.

About the author:

Robert Mullins is a reporter covering the technology industry from Silicon Valley. He writes about servers, storage, security, open source software and other topics.

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Robert Mullins coverage of network security, Pt 3

2009-01-05T15:02:00.000-08:00

The third in the series I wrote for SearchFinancialSecurity.com on high profile network security events, Lessons Learned: the Citibank ATM breach, was published Sept. 11, 2008:

The hacking of Citibank ATM networks, as well as exposing cardholder account numbers and personal identification numbers (PINs,) has given financial institutions new security worries and prompted them to review their security methods.

In a technology arms race between banks and thieves, financial institutions continually harden their networks in an attempt to thwart new attacks by crooks.

"These guys are trying to make a living as fraudsters and we're trying to stop them for a living," said Doug Johnson, vice president of risk management policy for the American Bankers Association (ABA).

The Citibank case

On Feb. 1, 2008, Citibank reported to the FBI that account and PINs had been pilfered from a server that handled transactions from Citibank-branded ATMs at 7-Eleven convenience stores. According to the FBI, the suspects, who are in custody, created new ATM cards encoded with the stolen account numbers and, with the PINs, withdrew cash from ATMs. Other court documents indicate the accused may have stolen as much as $3.6 million in various ATM fraud schemes.

The Microsoft effect

Experts say that the reason the Citibank accounts were hit follow the same logic behind Windows operating systems attacks -- they're both ubiquitous. Citibank is a global financial services enterprise with a vast IT infrastructure and 20,000 automated teller machines, while Microsoft's Windows runs on more than 90% of the world's personal computers and close to 70% of its servers. Increasingly, ATM networks are running on Microsoft's Windows operating system, which security experts say makes them more vulnerable than if they were run on a proprietary platform that would be harder for hackers to figure out. However, neither Citibank nor Microsoft would say whether Citibank's ATM network is Windows-based.

"You get more bang for the buck if you, as a hacker, invest in compromising Citibank's network because there's more of a network to attack, just like Windows," said Avivah Litan, an analyst at Stamford, Conn.-based Gartner, Inc.

Although Citibank wouldn't identify the processing firm, there are two companies that maintain the ATMs at 7-Eleven stores: Cardtronics, a Houston-based company that owns 5,500 ATMs in 7-Eleven stores and Fiserv Inc., of Brookfield Wis. Cardtronics maintains only 2,000 of the 5,500 ATMs it owns; Fiserv maintains the other 3,500. The publicly traded Cardtronics acquired the ATMs from 7-Eleven Financial Services, a division of the convenience store chain, in late 2007, according to an SEC filing.

Fiserv said through a spokeswoman that its servers were not hacked in the Citibank case. Cardtronics declined to comment for this story. In a July 2 news release it stated, "Cardtronics is not involved in this criminal prosecution and therefore does not anticipate that it will issue any statements with respect to this case."

PCI compliant ≠ secure

But Cardtronics added that all of its ATMs have encrypted PIN pads, triple data encryption and that its processing platform complies with the Payment Card Industry (PCI) data security standards.

However, being PCI compliant doesn't mean an ATM network is hacker-proof. "You can't say 'I'm PCI compliant,' and then wipe your hands and walk away," said Mike Urban, senior director of fraud solutions at Fair Isaac Corp., a provider of enterprise decision management automation in Minneapolis. "This is an ongoing security concern and should always be an ongoing concern."

Too many network administrators deploy only enough security to win PCI compliance, although that is changing, said Jim Pflaging, CEO of San Francisco-based SenSage, a provider of enterprise data warehousing tools.

Previously, some companies only met the minimum security standard. "They just want the [PCI] auditor to get out of their office," he said. Increasingly, though, others regard security as a form of risk management that is strategic to their business and go beyond the PCI standard.

ATM security evolving

Recently, ATM vendors have teamed up with security firms in order to develop new technology that will keep up with evolving hacker attacks. For instance, Wincor Nixdorf, a German ATM maker, partnered with Cisco Systems to develop the PC/E Platform Security Agent, which prevents software from being installed or modified without authorization. One theory behind the Citibank breach is that the hackers installed malicious software onto the servers to access the account numbers and PINs.

In another partnership, Diebold, Inc. is working with Agilis Software LLC. to secure its Opteva ATM line with anti-skimming technology. Skimming involves placing a fake ATM card slot over the real one in order to read card numbers and PINs as they go in.

But such point products don't provide a comprehensive security net, SenSage's Pflaging argued. However, data warehousing technology, which records every event on a network, can help identify patterns or connections between incidents that indicate potential thievery. For example, if an ATM card is used in Chicago and, moments later, in Moscow, that's a sign of trouble, Pflaging said. If a bank employee accesses the network and, soon after, moves a large file off the network, the action deserves closer scrutiny.

"You put your Inspector Clouseau hat on and you can start to look for all of these very unusual cases," Pflaging said, adding that it's possible criminals in the Citibank case could have been aided by someone inside Citibank "or someone who has somehow obtained the credentials of one of your trusted insiders."

Despite all these security breakthroughs, Windows-based ATM networks are a popular choice amongst financial institutions. According to Pflaging, Windows makes sense as an operating system because it's low cost and is easy for banks to manage, especially on global networks that span different countries, said Pflaging. "But, Windows is just an outright, big invitation to security hackers."

Even though Windows makes a big target, it can be secured, countered Gartner's Litan. "If you keep Windows locked down and you keep your network locked down, then it's no worse or better than any other system. It's just a question of locking it down and not allowing anyone to get in."

About the author:

Robert Mullins is a reporter covering the technology industry from Silicon Valley. He writes about servers, storage, security, open source software and other topics.

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Robert Mullins coverage of network security , Pt. 2

2009-01-05T14:51:00.000-08:00

Four your consideration, another in the SearchFinancialSecurity.com series on high-profile security failures. This one, published Nov. 5, 2008, is titled Lessons Learned: The Countrywide Financial breach:

The FBI affidavit in the case of the data breach at Countrywide Financial Corp. reads like the script of a TV crime drama.

The FBI informant meets in a bar with two guys who have information to sell. One goes by the name of "Nico," the affidavit reads, while the other is introduced as "Rebollo." Rebollo is Rene Rebollo, who is now facing trial in federal court in Los Angeles for stealing mortgage customer data from Countrywide, while Nico, Wahid Siddiqi, is facing trial for fraud.

According to an FBI agent, Rebollo, on Sunday nights, went to the Countrywide Home Loan office at which he worked in Pasadena, California. Over a period of two years, when no one else was around, he'd regularly insert a flash drive into a computer and copy thousands of customer records. Siddiqi allegedly helped fence the data, selling it as sales leads to other mortgage brokers. In one deal witnessed by an FBI agent, Siddiqi showed another informant data on a compact disk running on a laptop computer.

"It's the bombest data," Siddiqi boasted, meaning they were promising leads.

Data breaches: Inside jobs or outside attacks?

The Countrywide case illustrates that no matter how much financial institutions invest in security, some breaches still occur. Industry analysts say it's because enterprises either use outdated technology or leave gaping holes in their security that can be easily exploited. Most troubling is the fact that, more often than not, data breaches are an inside job.

"There is a rampant access control and authorization control problem in the enterprise," including financial institutions, says Perry Carpenter, a research director at Connecticut-based Gartner Research Inc., specializing in security and privacy issues.

A study released Oct. 13 by the software firm Compuware Corp. and conducted by the Ponemon Institute stated that 75% of data breaches reported by enterprises were committed by employees; external hackers were the culprits in only 1% of cases.

"You have to extend trust to the people that are working for you, but the very fact that [employers] have to extend trust opens them up to vulnerability," Carpenter said.

Countrywide was conscientious enough to have a safety feature on its computers that prevented people from downloading files onto external devices such as flash drives. But, according to the FBI affidavit, Rebollo used the one computer in the Pasadena office that did not have that feature.

Countrywide, through a spokeswoman, declined to comment for this article. The company, which has since been acquired by Bank of America Corp., has offered two years of a free credit monitoring service to Countrywide customers whose records may have been compromised.

The security scandal comes amid other bad news for Countrywide, which has been accused of using unfair business practices to sell subprime loans to borrowers. Connecticut Attorney General Richard Blumenthal, who is already suing Countrywide over its loan practices, criticized it for allowing this breach.

"Countrywide consumers justifiably want an explanation for a long-term security failure that enabled an employee -- undetected and uncontrolled -- to download sensitive information over an extended period of time," Blumenthal stated in a Sept. 10 news release.

A Countrywide spokesman, quoted in a Los Angeles Times story that same day, disputed reports that as many as two million customer accounts were exposed, but added that Countrywide believes there have been no reports of identity theft or other fraud affecting its customers as a result of the breach.

Caught in the act

FBI documents describe a scheme in which Rebollo downloaded as many as 20,000 customer account records, including name, address, loan amounts and Social Security numbers, nearly each week between 2006 and 2008. He sold each batch of data, either on a thumb drive, compact disk or as an email attachment for $500. "Rebollo estimated that he made $50,000 to $70,000 over the course of two years by selling the Countrywide Home Loan data," an FBI affidavit states.

Rebollo initially cooperated with the FBI, meeting with agents July 15, 2008 and allowing them to take his desktop computer and a thumb drive from his Pasadena apartment as evidence. Two days later, though, Rebollo hired an attorney who advised him to revoke his cooperation, requiring the FBI to get a warrant. But despite knowing the FBI was on to him, Rebollo tried to sell more data. An FBI affidavit says Rebollo was on the phone July 23rd with an informant posing as a buyer and was negotiating yet another sale.

Rebollo is charged with exceeding authorized access to the computer of a financial institution, a federal crime that carries a maximum five-year prison term. His lawyer, Michael Severo, has not returned a call for comment. Saddiqi is charged with fraud related to his role in the scheme and is facing a maximum 15-year sentence. His attorney, Jeffrey Lipow, has also not returned a call for comment.

Lessons learned from the Countrywide breach

Although not privy to all the facts of the Countrywide breach, Gartner's Carpenter says the case illustrates the need for financial services firms and all other enterprises to have defense in depth protecting their networks and sensitive company data.

In a July 25 report to Gartner clients, Carpenter writes that enterprises need more than just technology to protect data; they also need management policies and a corporate culture that stresses integrity.

Besides password protection, enterprises should deploy network monitoring software that looks for suspicious data traffic, such as an employee in the office downloading large data files on a Sunday night. But that alone may not be enough for salaried employees who sometimes work odd hours. "It may not set off an alarm bell that they are there on a Sunday," he says.

Another vulnerability that may be overlooked involves software applications that access customer databases for various purposes, Carpenter added. An application may scour records to identify customers with the best FICO scores to market a credit card or another financial product to them. Usually, when an employee leaves a company, their password is revoked, but those applications also use passwords that could fall into the wrong hands.

"Over time, people learn about these accounts and it's more likely that if you steal that user ID and password, it's still going to be in effect a year after you leave," Carpenter says.

But more than technology, companies also need to keep employees honest, he concludes. Companies need to schedule regular security training to maintain employee awareness of the need to protect data for the benefit of customers, shareholders and the company. Even something as simple as posting signs about security procedures are another reminder. Steps not related to technology, such as job rotation, segregation of work duties and mandatory vacations, are also part of a layered approach to security.

One last bit of advice sounds counterintuitive: Carpenter advises against "password expiration," in which employees are required to create new passwords for network access at regular intervals. If passwords change frequently, some employees may have trouble remembering them, prompting some to write them down, which increases, rather than reduces, vulnerability.

About the author:

Robert Mullins is a reporter covering the technology industry from Silicon Valley. He writes about servers, storage, security, open source software and other topics.

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Robert Mullins coverage of network security, Pt. 1

2009-01-05T14:30:00.000-08:00

Here are clips to one of the stories I wrote recently on the subject of network security. I've been chosen by an editor at SearchFinancialSecurity.com to write a couple of articles detailing security breaches at high-profile companies for a series called "Lessons Learned."
Lessons Learned: The Lending Tree breach was published Nov. 13, 2008. Because finding the article via the link requires a username and password, I've pasted it in for you below:

LendingTree's advertising slogan, "When banks compete, you win," is the subject of mockery in the wake of a security breach in which customer data was stolen.

"When banks get breached, you lose!" wrote a commenter on The Consumerist, a consumer protection website.

The case

LendingTree, LLC was forced to admit April 21, 2008 that former employees of the online mortgage broker had obtained customer passwords and shared them with non-LendingTree-approved mortgage lenders so those lenders could market their loans to those customers. Although the company sued the parties involved in the breach in a state court in California, multiple LendingTree customers have sued LendingTree in federal court for lax network security.

"We regret any inconvenience," stated "RL Harris" in an April 21 letter to customers, an apparent reference to Robert L. Harris, president of LendingTree. Harris disclosed that former employees shared customer passwords with non-approved lenders and that, with that access, the non-approved lenders could view the customers' applications for mortgages. He further stated that the unauthorized access began as far back as October 2006.

"The loan request forms contained data such as name, address, email address, telephone number, Social Security number, income and employment information," he acknowledged. While such data can be a treasure trove for identity thieves, Harris sought to reassure customers: "We don't believe any identity theft or fraudulent financial activity resulted from this situation." LendingTree, through a spokeswoman, declined a request for comment for this story.

At the time the breach was reported, LendingTree, of Charlotte, N.C., was a unit of IAC/InterActiveCorp. It was spun off as its own publicly traded company, Tree.Com Inc., on Aug. 21.

Simultaneous to disclosure of the breach, LendingTree filed suit against five mortgage lenders in Southern California, which it accuses of fraud for using its customer records without permission. The companies are: Newport Lending Corp.; Southern California Marketing; Sage Credit Co.; Chapman Capital Inc.; and Home Loan Consultants.

The aftermath

At the same time LendingTree is the plaintiff in the California case, it is the defendant in a number of federal lawsuits filed by LendingTree customers outraged at their records being compromised.

In one such case, customer Marvin Garcia, of New York City, sued LendingTree in U.S. District Court in Manhattan July 29 accusing it of negligence, invasion of privacy and violation of the U.S. Fair Credit Reporting Act, which requires companies "to maintain reasonable procedures designed to limit the use of consumer reports [to] permissible purposes."

The suit, which has since been consolidated with other customer lawsuits in North Carolina, where LendingTree is based, also names the same non-approved lenders that LendingTree sued in California, stating: "The mortgage lenders used the passwords of LendingTree's customers to access the … customer loan request forms to market loans [to them]."

"Lending Tree knew or should have known that its network for processing and storing customer loan request forms…had security vulnerabilities," the lawsuit states.

In announcing the filing of the Garcia suit, his law firm, Meiselman Denlea, of White Plains, N.Y., criticized LendingTree for waiting so long before warning customers after it discovered the breach, and for only advising customers to get a credit check and monitor their credit reports going forward -- at their own expense.

Reputation risk cannot be ignored

LendingTree can be expected to take heat for this in the court of public opinion as well as in real courts, said Dana Wiklund, research director for global risk management at Financial Insights, a unit of the research firm IDC focused on the financial services industry.

"It opens up Lending Tree to reputation risk," Wiklund acknowledged. However, he added, this breach could have been a lot worse. So far, there's no evidence that the unauthorized access to customer records has resulted in any identity theft or fraud against those customers (although the customers' lawsuits argue they are still at risk). And while it's unclear exactly how many LendingTree customer records were exposed, he doesn't see this case being on the scale of other breaches.

"The fact that the data went to maybe other mortgage brokers and marketers is a big distinction from losing a tape with a million socials on it and finding out that some of these socials are popping up with international fraud rings," said Wiklund. He added that the mortgage brokers or lenders who gained the unauthorized access are likely one- or two-person shops whose only motivation was to try to drum up some business.

Nonetheless, he concluded, LendingTree is going to have to go back, see what went wrong and fix it.

Password protection

That LendingTree employees could access customer passwords and share them with outside parties is puzzling to Jeremy Duffy, a self-described technology privacy awareness advocate and host of an online "Computer and Internet Safety for Normal People" seminar. Duffy finds it hard to believe that employees could access even their own customers' passwords.

What needs to be determined is if the passwords were encrypted or not. If they were encrypted, Duffy said, "There would be almost no way for someone to know the actual passwords even if they could directly access the database." If they were not encrypted, but stored in plain text, "that allows anyone with database access to see the customer's actual passwords and that is a huge security issue."

Duffy recommends a simple test. If a user clicks on the "Lost Password" button on a log-in page and the site sends them an email with their password, the passwords are likely stored in plain text. If it sends back a randomly generated password for the user to go in and reset their password, it's probably encrypted.

LendingTree's privacy policy posted on its website states that the company uses "well-known and vetted security technologies." Web pages on which customers enter their personal information are delivered to their browser through HTTPS, a secure server communications protocol. Transmission between the browser and LendingTree's servers is encrypted using Secure Sockets Layer (SSL) technology.

Yet, the privacy policy begins with a telling caveat: "No data transmission over the Internet or information storage technology can be guaranteed to be 100% secure."

About the author:

Robert Mullins is a reporter covering the technology industry from Silicon Valley. He writes about servers, storage, security, open source software and other topics.

To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Welcome to the Robert Mullins Blog

2009-01-05T14:09:00.000-08:00

Hi. I'm a technology writer in Silicon Valley who has worked for various business and trade publications. Times are tough for such publishers these days and the business model may have changed for them permanently. I have talent and experience to offer the media marketplace and have set up this site to showcase what I have to offer. If the marketplace has a full time position for me, great. If not, this site should show employers the variety of subjects I can write about on a freelance basis.
On this site are many examples of the variety of business and tech subjects I have written about and can write about for you.
Let's see what we can accomplish together.
Thanks,
Robert Mullins
To inquire about Robert Mullins' availability for full or part time work, please write me at mullico@gmail.com or call at 408-243-4302.

Robert Mullins

Confessions of a census thug

Posts on handset makers, carriers and Oracle

Persuasive Marketing

Posts the week of Oct. 19

Gov. Schwarzenegger at Oracle gathering

Busy day Monday with Sidekick debacle

My report on AT&T Prepaid phone plan

On AT&T, Apple, BlackBerry and other gadget news

Ellison on pending acquisition of Sun

Recent Examiner posts

Busy Tuesday

Good and Bad News About Apple

Apple and AT&T irk fans of iPhone and Google Voice

More on netbooks, Symbian

My latest Examiner.com posts

Netbook or Notebook

Solar-powered cell phone recharger

New iPhone spurs market for refurbished phones

Latest posts to Examiner.com

Busy day on the tech beat

My coverage of the iPhone 3G S launch

My continuing coverage of Pre v. iPhone

It's hard out there for an iPhoner

Apple iPhone 3G S, the S is for SPEED!

Palm Pre launch

JavaOne

Examiner.com Postings

Robert reporting from the RSA Conference

More Examiner posts

New Examiner post

My new role as an "Examiner"

Venture Capital Forecast 2009

Future of Newspapers

When the housing crisis gets literally too close to home

Worst of Recession Lies Ahead

A burst of creative energy on Suite101.com

Robert the car guy

E-discovery versus Web 2.0

GigaOM Post

IDG News/Network World

Robert can take photos, too

Coverage of software development

Blog for GigaOM, too

I can blog, too, Pt. 1

Robert Mullins coverage of network security, Pt. 4

Robert Mullins coverage of network security, Pt 3

Robert Mullins coverage of network security , Pt. 2

Robert Mullins coverage of network security, Pt. 1

Welcome to the Robert Mullins Blog