Today's children often use mobile devices at very young ages... four, five, or six years of age. And they don't know anything about online dangers: computer viruses, stalking, cyber-bullying, identity theft, phishing scams, ransomware, and more. Nor do they know how to read terms-of-use and privacy policies. It is parents' responsibility to teach them.
"1. Set an example: If you want your kid to be careful and responsible online, you should start with yourself."
Children watch their parents. If you practice good online safety habits, they will learn from watching you. And:
"2. Start talking to your kid early and do it often: If your child already knows how to play a video on Youtube or is able to download a gaming app without your help, they also should learn how to do it safely. Therefore, it’s important to start explaining the basics of privacy and cybersecurity at an early age."
So, long before having the "sex talk" with your children, parents should have the online safety talk. Developing good online safety habits at a young age will help children throughout their lives; especially as adults:
"3. Explain why safe behavior matters: Give relatable examples of what personal information is – your address, social security number, phone number, account credentials, and stress why you can never share this information with strangers."
You wouldn't give this information to a stranger on a city street. The same applies online. That also means discussing social media:
"4. Social media and messaging: a) don’t accept friend requests from people you don’t know; b) never send your pictures to strangers; c) make sure only your friends can see what you post on Facebook; d) turn on timeline review to check posts you are tagged in before they appear on your Facebook timeline; e) if someone asks you for some personal information, always tell your parents; f) don’t share too much on your profile (e.g., home address, phone number, current location); and g) don’t use your social media logins to authorize apps."
Headlines from Def Con, a hacking conference held this month in Las Vegas, might have left some thinking that infiltrating state election websites and affecting the 2018 midterm results would be child’s play.
But now, elections experts are raising concerns that misunderstandings about the event — many of them stoked by its organizers — have left people with a distorted sense of its implications.
In a website published before r00tz Asylum, the youth section of Def Con, organizers indicated that students would attempt to hack exact duplicates of state election websites, referring to them as “replicas” or “exact clones.” (The language was scaled back after the conference to simply say “clones.”)
Instead, students were working with look-a-likes created for the event that had vulnerabilities they were coached to find. Organizers provided them with cheat sheets, and adults walked the students through the challenges they would encounter.
Josh Franklin, an elections expert formerly at the National Institute of Standards and Technology and a speaker at Def Con, called the websites “fake.”
“When I learned that they were not using exact copies and pains hadn’t been taken to more properly replicate the underlying infrastructure, I was definitely saddened,” Franklin said.
Franklin and David Becker, the executive director of the Center for Election Innovation & Research, also pointed out that while state election websites report voting results, they do not actually tabulate votes. This information is kept separately and would not be affected if hackers got into sites that display vote totals.
“It would be lunacy to directly connect the election management system, of which the tabulation system is a part of, to the internet,” Franklin said.
Jake Braun, the co-organizer of the event, defended the attention-grabbing way it was framed, saying the security issues of election websites haven’t gotten enough attention. Those questioning the technical details of the mock sites and whether their vulnerabilities were realistic are missing the point, he insisted.
“We want elections officials to start putting together communications redundancy plans so they have protocol in place to communicate with voters and the media and so on if this happens on election day,” he said.
Braun provided ProPublica with a report that r00tz plans to circulate more widely that explains the technical underpinnings of the mock websites. They were designed to be vulnerable to a SQL injection attack, a common hack, the report says.
Franklin acknowledged that some state election reporting sites do indeed have this vulnerability, but he said that states have been aware of it for months and are in the process of protecting against it.
Becker said the details spelled out in the r00tz report would have been helpful to have from the start.
“We have to be really careful about adding to the hysteria about our election system not working or being too vulnerable because that’s exactly what someone like President Putin wants,” Becker said. Instead, Becker said that “we should find real vulnerabilities and address them as elections officials are working really hard to do.”
In December 2017, Facebook launched its Messenger Kids service for children ages six to 13. The service includes a free video calling and messaging app where children can connect only with parent-approved contacts. The ad-free service includes masks, frames, stickers and GIFs for children to, "ids can create fun videos and decorate photos to share moments with loved ones."
"Given Facebook’s enormous reach and marketing prowess, Messenger Kids will likely be the first social media platform widely used by elementary school children. But a growing body of research demonstrates that excessive use of digital devices and social media is harmful to children and teens, making it very likely this new app will undermine children’s healthy development.
Younger children are simply not ready to have social media accounts. They are not old enough to navigate the complexities of online relationships, which often lead to misunderstandings and conflicts even among more mature users. They also do not have a fully developed understanding of privacy, including what’s appropriate to share with others and who has access to their conversations, pictures, and videos.
At a time when there is mounting concern about how social media use affects adolescents’ well being, it is particularly irresponsible to encourage children as young as preschoolers to start using a Facebook product. Social media use by teens is linked to significantly higher rates of depression, and adolescents who spend an hour a day chatting on social networks report less satisfaction with nearly every aspect of their lives. Eighth graders who use social media for 6 - 9 hours per week are 47% more likely to report they are unhappy than their peers who use social media less often. A study of girls between the ages of 10 and 12 found the more they used social networking sites like Facebook, the more likely they were to idealize thinness, have concerns about their bodies, and to have dieted. Teen social media use is also linked to unhealthy sleep habits. Messenger Kids is likely to increase the amount of time pre-school and elementary age kids spend with digital devices. Already, adolescents report difficulty moderating their own social media use: 78% check their phones at least hourly, and 50% say they feel addicted to their phones. Almost half of parents say that regulating their child’s screen time is a constant battle. Messenger Kids will exacerbate this problem... Encouraging kids to move their friendships online will interfere with and displace the face-to-face interactions and play that are crucial for building healthy developmental skills, including the ability to read human emotion, delay gratification, and engage with the physical world..."
The letter from health professionals to Facebook also addressed safety concerns:
"Facebook claims that Messenger Kids will provide a safe alternative for the children who have lied their way onto social media platforms designed for teens and adults. But the 11- and 12-year-olds who currently use Snapchat, Instagram, or Facebook are unlikely to switch to an app that is clearly designed for younger children. Messenger Kids is not responding to a need – it is creating one. It appeals primarily to children who otherwise would not have their own social media accounts. It is disingenuous to use Facebook’s failure to keep underage users off their platforms as a rationale for targeting younger children with a new product."
Jim Neal, the president of the American Library Association, released a statement condemning the December 14th vote by the Republican-led U.S. Federal Communications Commission (FCC) to kill net neutrality protections for internet users:
"The majority of the FCC has just dealt a blow to equitable access to online information and services which puts libraries, our patrons, and America’s communities at risk... By rolling back essential and enforceable net neutrality protections, the FCC has enabled commercial interests at the expense of the public who depends on the internet as their primary means of information gathering, learning, and communication. We will continue to fight the FCC’s decision and advocate for strong, enforceable net neutrality protections."
The Verge interviewed New York Public Library (NYPL) president Tony Marx, and Greg Cam the NYPL director of information policy. During 2017, the NYPL provided 3.1 million computer sessions across all branches (using 4,700 computers), plus 3 million wireless sessions. Based upon that activity, Marx said:
"... the simple fact is that the poorest of New York rely on the library as the only place they can go and get free use of computers and free Wi-Fi. It’s one of the reasons why the library is the most visited civic institution in New York. We have also, in recent years, been lending people what we call hot spots, which are Wi-Fi boxes they can take home, typically for a year. That gives them digital access at home — broadband access — which something like 2 million New Yorkers can’t afford and don’t have..."
And, New York City is one of the more prosperous areas of the country. It makes one wonder how citizens in poor or rural areas; or in areas without any public libraries will manage. Disabled users will also be negatively affected by the FCC vote. Marx explained:
"... the New York Public Library runs the Andrew Heiskell Library for the visually impaired. I believe it is a three-state depository, so it plays a role in getting access in all the ways you described — not just in New York City but way beyond. A lot of that now happens online and it could simply stop working, which means they’re gonna cut people off completely."
Cram explained the wide range of tasks people use the internet for at public libraries:
"Our users depend on the library, and libraries in general, for things like completing homework assignments, locating e-government resources, e-government services, accessing oral histories and primary source materials. Things that are resource-intensive like video and audio and image collections are dependent on a free and open internet. Also things like applying and interviewing for jobs. More and more jobs involve a first round of interviews that are done over the internet. If we have to put things in the slow lane, we’re worried about those interview services being downgraded."
"We live in a world where access to information is essential for opportunity, for learning, for success, for civic life, for checking facts. Anything that reduces that, particularly for people who can’t afford alternatives, is a body blow to the basic democratic principles that the library stands for. Whether people or the library are shoved to the slow lane, and/or forced to pay to be in the fast lane with resources that are already stretched thin, is really sort of shocking. To put it sort of bluntly, the FCC should be defending communications."
Basically, internet access is a utility like water or electricity; something corporate providers have long denied and fought. Everyone needs and uses broadband internet. What are your opinions?
"Germany's Federal Network Agency (Bundesnetzagentur), the country's telecommunications agency, has banned the sale of children's smartwatches after it classified such devices as "prohibited listening devices." The ban was announced earlier today... parents are using their children's smartwatches to listen to teachers in the classroom. Recording or listening to private conversations is against the law in Germany without the permission of all recorded persons."
Some smartwatches are designed for children as young as four years of age. Several brands are available at online retailers, such as Amazon and Best Buy.
"Saying the technology more closely resembles a “spying device” than a toy... Last month, the European Consumer Organization (BEUC) warned that smartwatches marketed to kids were a serious threat to children’s privacy. A report published by the Norwegian Consumer Council in mid-October revealed serious flaws in several of the devices that could easily allow hackers to seize control. "
Clearly, this is another opportunity for parents to carefully research and consider smart device purchases for their family, to teach their children about privacy, and to not record persons without their permission.
The Guardian news site in the United Kingdom (UK) published the findings of its review of "The Facebook Files" -- a collection of documents which comprise the rules used by executives at the social site to moderate (e.g., review, approve, and delete) content posted by the site's members. Reporters at The Guardian reviewed:
"... more than 100 internal training manuals, spreadsheets and flowcharts that give unprecedented insight into the blueprints Facebook has used to moderate issues such as violence, hate speech, terrorism, pornography, racism and self-harm. There are even guidelines on match-fixing and cannibalism.
The Guardian summarized what it learned about Facebook's revenge porn rules for moderators:
Reportedly, Facebook moderators reviewed as many as 54,000 cases in a single month related to revenge porn and "sextortion." In January of 2017, the site disabled 14,000 accounts due to this form of sexual violence. Previously, these rules were not available publicly. Findings about other rules are available at The Guardian site.
Other key findings found by The Guardian during its document review:
"One document says Facebook reviews more than 6.5m reports a week relating to potentially fake accounts – known as FNRP (fake, not real person)... Many moderators are said to have concerns about the inconsistency and peculiar nature of some of the policies. Those on sexual content, for example, are said to be the most complex and confusing... Anyone with more than 100,000 followers on a social media platform is designated as a public figure – which denies them the full protections given to private individuals..."
The social site struggles with how to handle violent language:
"Facebook’s leaked policies on subjects including violent death, images of non-sexual physical child abuse and animal cruelty show how the site tries to navigate a minefield... In one of the leaked documents, Facebook acknowledges “people use violent language to express frustration online” and feel “safe to do so” on the site. It says: “They feel that the issue won’t come back to them and they feel indifferent towards the person they are making the threats about because of the lack of empathy created by communication via devices as opposed to face to face..."
Some industry watchers in Europe doubt that Facebook can do what it has set out to accomplish, lacks sufficient staff to effectively moderate content posted by almost 2 billion users, and Facebook management should be more transparent about its content moderation rules. Others believe that Facebook and other social sites should be heavily fined "for failing to remove extremist and hate-crime material."
To learn more, The Guardian site includes at least nine articles about its review of The Facebook Files:
"... experienced higher rates of unemployment and lower rates of labor force participation than the general population for at least two decades, and the Great Recession exacerbated this phenomenon. Despite a substantial labor market recovery from 2009 through 2014, vulnerable populations—including the nation’s young adults—continue to experience higher rates of unemployment. Changes in labor market conditions, including globalization and automation, have reduced the availability of well-paid, secure jobs for less-educated persons, particularly those jobs that provide opportunity for advancement. Furthermore, data suggest that young workers entering the labor market are affected by a long-running increase in the use of “contingent” or “alternative” work arrangements, characterized by contracted, part-time, temporary, and seasonal work."
Specific findings about younger workers' attitudes:
"In 2015, the majority of young adults (61 percent) are optimistic about their future job opportunities, showing an increase in optimism from 2013 (45 percent)... the likelihood that a young adult is optimistic about future job opportunities increases with higher levels of education... young adults continue to have a strong preference for steady employment (62 percent) over higher pay (36 percent)... Among respondents who prefer steady employment, 80 percent would rather have one steady job than a stream of steady jobs for the next five years...
Most young adults are not sure how their standard of living will compare with their parents’ standard of living. Young adults with at least one parent with a bachelor’s degree (or higher) are more likely to believe their standard of living will be lower than their parents (4 percent) when compared with young adults whose parents have a high school education or less (1 percent)...
Specific findings about younger workers' experiences:
"28 percent of respondents are currently enrolled as students in a certificate or degree program. Most students are enrolled in degree programs... most undergraduate students are identified “nontraditional” because they are over age 23, enrolled in school part time, working full time, and/or financially independent. 10 percent of respondents are “non-completers,” meaning they are not currently enrolled in a certificate or degree program they started... 62 percent of respondents with post-secondary education worked while in school to finance all or part of their most recent education. 52 percent of respondents with post-secondary educational experience have parents that contributed financially to their education. 46 percent of respondents incurred debt to pay for some portion of their education or training...
41 percent of respondents believe they have the level of education and training needed for the type of job that they would like to hold in the next five years... 66 percent of young adults received information about jobs and careers during high school. And, 69 percent of young adults received such information in college...
Less than half (45 percent) of employees work in a career field that is closely related to their educational and training background... Many young adults gained early work experience during high school, college, or both. 53 percent of young adults had a paid job during high school, and 77 percent of young adults had a paid job during college..."
A key takeaway: about 30 percent of young adults did not receive information about jobs and careers in high school nor college. That seems to be an area the educational sector must improve upon.
4,135 potential respondents were contacted for the 2015 survey, and 2,035 completed surveys (49 percent response rate). FRB staff designed the survey, which was administered by GfK, an online consumer research company.
More notable statistics from the survey: about 69 percent of survey respondents have some form of paid employment, up from 60 percent in 2013. 63 percent of employees held a single full-time job during the past year, and 18 percent of employees held multiple full-time jobs during the past year. Profile information about employed younger workers:
"78 percent of employees have a permanent/long-term job... 75 percent of employees in the survey have a full-time job... Among part-time employees surveyed, 49 percent were identified as underemployed, as they are working part time because of economic conditions. Meanwhile, 42 percent of part-time employees prefer part-time work... The percent of young workers who have health insurance increased from 2013 (70 percent) to 2015 (82 percent). Likewise, the percent of young workers who received paid time off for sick leave, holidays, or both from any of their paid jobs increased from 2013 (59 percent) to 2015 (62 percent)...
As adults, 43 percent of employees have formed a new household with their immediate family (i.e., spouse/partner), and 20 percent have formed a new household alone or with a roommate..."
Self-sufficiency is important. The report found:
"... 73 percent of employees are able to cover their monthly household expenses with their household income. Meanwhile, 22 percent of employees report that they are sometimes able to cover their monthly household expenses, and 4 percent are not able to cover their monthly household expenses at all... Among employees who are not able to cover their household expenses some or all of the time, 64 percent reduce their monthly expenses to meet the challenge, 56 percent do not pay some bills, 54 percent borrow money from family, 46 percent use their credit cards, 41 percent use savings, and 16 percent borrow from friends.
A key consideration regarding self-sufficiency is the ability of a household to withstand financial disruptions. Among young workers, the ability to go without a paycheck temporarily improved between 2013 and 2015. The percent of young workers who can pay their living expenses if out of work for four weeks improved from 38 percent in 2013 to 45 percent in 2015..."
The report cited 4 policy implications to address the findings:
Improve Alignment between Education and the Labor Market
Increase Opportunities for Non-degree Education
Provide Assistance and Protections for Workers with Alternative Work Arrangements
Seek Opportunities to Improve Job Growth
There is plenty of information in the 120-page report, which is available at the FRB site and here (Adobe PDF; 1,190.2K bytes).
Earlier this month, the Attorney General for the State of New York (NYSAG) announced settlement agreements with the operators of several popular websites for the illegal online tracking of children, which violated the Children's Online Privacy Protection Act (COPPA). The website operators agreed to pay a total of $835,000 in fines, comply with, and implement a comprehensive set of requirements and changes.
COPPA, passed by Congress in 1998 and updated in 2013, prohibits the unauthorized collection, use, and disclosure of children’s personal information (e.g., first name, last name, e-mail address, IP address, etc.) on websites directed to children under the age of 13, including the collection of information for tracking a child’s movements across the Internet. The 2013 update expanded the list of personal information items, and prohibits covered operators from using cookies, IP addresses, and other persistent identifiers to track users across websites for most advertising purposes, amassing profiles on individual users, and serving targeted behavioral advertisements.
The NYSAG operated a program titled "Operation Child Tracker," which analyzed the most popular children’s websites for any unauthorized tracking. The analysis found that four website operators include third-party tracking on their websites -- which is prohibited by COPPA -- and failed to properly evaluate third-party companies, such as advertisers, advertising networks, and marketers. The website operators and their properties included Viacom (websites associated with Nick Jr. and Nickelodeon), Mattel (Barbie, Hot Wheels, and American Girl), JumpStart (Neopets), and Hasbro (My Little Pony, Littlest Pet Shop, and Nerf).
Regular readers of this blog are familiar with the variety of technologies and mechanisms companies have used to track consumers online: web browser cookies, “zombie cookies,” Flash cookies, “zombie e-tags,” super cookies, “zombie databases” on mobile devices, canvas fingerprinting, and augmented reality (which tracks consumers both online and in the physical world). For example, the web browser cookie is a small text file placed by a website on a user’s computer which is stored by the user’s web browser. Every time a user visits the website, the website retrieves all cookies files stored by that website on the user’s computer. Some website operators shared the information contained in web browser cookies with third-party companies, such as marketing affiliates, advertisers, and tracking companies. This allows web browser cookies to be used to track a user’s browsing history across several websites.
All of this happens in the background without explicit notices in the web browser software, unless the user configures their web browser to provide notice and/or to delete all browser cookies stored. The other technologies represent alternative methods with more technical sophistication and stealth.
The announcement by the NYSAG described each website operator's activities:
"Viacom operates the Nick Jr. website, at www.nickjr.com, and the Nickelodeon website, at www.nick.com... The office of the Attorney General found a variety of improper third party tracking on the Nick Jr. and Nickelodeon websites. These included:
1. Many advertisers and agencies that placed advertisements on Nick Jr. and Nickelodeon websites introduced tracking technologies of third parties that routinely engage in the type of tracking, profiling, and targeted advertising prohibited by COPPA. Viacom considered several approaches to mitigate the risk of COPPA violations from these third parties, including removing adult advertising from a child-directed section of the Nick Jr. website and monitoring advertisements for unexpected tracking... However, Viacom did not timely take either approach and did not implement sufficient safeguards for its users.
2. Some visitors to the homepage of the Nick Jr. website were served behavioral advertising and tracked through a third party advertising platform Viacom used to serve advertisements. Although Viacom considered the homepage of the Nick Jr. website to be parent-directed, and thus not covered by COPPA, the homepage had content that appealed to children. Under COPPA, website operators must treat mixed audience pages as child-directed..."
The NYSAG also found:
"... 26 of Mattel’s websites feature content for young children, including online games, animated cartoons, and downloadable content such as posters, computer desktop wallpaper, and pages for young children to color... The office of the Attorney General found that a variety of improper third party tracking technologies were present on Mattel’s child-directed websites and sections of websites. These included:
1. Mattel deployed a tracking technology supplied by a third party data broker across its Barbie, Hot Wheels, Fisher-Price, Monster High, Ever After High, and Thomas & Friends websites. Mattel used the tracking technology for measuring website metrics, such as the number of visitors to each site, a practice permitted under COPPA. However, the tracking technology supplied by the data broker introduced many other third party tracking technologies in a process known as “piggy backing.” Many of these third parties engage in the type of tracking, profiling, and targeted advertising prohibited by COPPA.
2. A tracking technology that Mattel deployed on the e-commerce portion of the American Girl website, which is not directed to children or covered by COPPA, was inadvertently introduced onto certain child-directed webpages of the American Girl website.
3. Mattel uploaded videos to Google’s YouTube.com, a video hosting platform, and then embedded some of these videos onto the child-directed portion of several Mattel websites, including the Barbie website. When the embedded videos were played by children, it enabled Google tracking technologies, which were used to serve behavioral advertisements.
Regarding JumpStart, the NYSAG found:
"... several improper third party tracking technologies were present on the Neopets website, both for logged-in users under the age of 13 and users who were not logged-in. These included:
1. JumpStart failed to configure the advertising platform used to serve ads on the Neopets website in a manner that would comply with COPPA. As a result, users under the age of 13 were served behavioral advertising and tracked through the advertising platform.
2. JumpStart integrated a Facebook plug-in into the Neopets website... Facebook uses the tracking information for serving behavioral advertising, among other things, unless the website operator notifies Facebook with a COPPA flag that the website falls is subject to COPPA. JumpStart did not notify Facebook that the Neopets website was directed to children."
For Hasbro, the NYSAG found:
"... several improper third party tracking technologies were present on Hasbro’s child-directed websites and sections of websites. These included:
1. Hasbro engaged in an advertising campaign that tracked visitors to the Nerf section of Hasbro’s website in order to serve Hasbro advertisements to those same users as they visited other websites at a later time, a type of online behavioral advertising prohibited by COPPA known as “remarketing.”
2. Hasbro integrated a third-party plug-in into many of its websites, that allowed users to be tracked across websites and introduced other third parties that engaged in the type of tracking, profiling, and targeted advertising prohibited under COPPA.
It is important to note that Hasbro participated in a safe harbor program. A website operator that complies with the rules of an FTC-approved safe harbor program is deemed in compliance with COPPA. However, safe harbor programs rely on full disclosure of the operator’s practices and Hasbro failed to disclose the existence of the remarketing campaign through the Nerf website."
The terms of the settlement agreements require the website operators to:
Conduct regular electronic scans for unexpected third party tracking technologies that may appear on their children’s websites. Three of the companies, Viacom, Mattel, and JumpStart will provide regular reports to the office regarding the results of the scans.
Adopt procedures to evaluate third-party companies before they are introduced onto their children’s websites. the evaluation should determine whether and how the third parties collect, use, and disclose, and allow others to collect, use, and disclose, personal information from users.
Provide notice to third parties that collect, use, or disclose personal information of users with information sufficient to enable the third parties to identify the websites or sections of websites that are child directed pursuant to COPPA.
Update website privacy policies with either, a) information sufficient to enable parents and others to identify the websites and portions of websites that are directed to children under COPPA, or b) a means of contacting the company so that parents and others may request such information.
Kudos to the NYSAG office and staff for a comprehensive analysis and enforcement to protect children's online privacy. This type of analysis and enforcement is critical as companies introduce more Internet-connected toys and products classified as part of the Internet of Things (ioT).
Recently, my family and I sailed on Royal Caribbean cruise line's Allure of the Seas mega-ship from Fort Lauderdale, Florida to destinations in the Caribbean: St, Kitts, St. Thomas (USVI), and Nassau, Bahamas. This was our 26th cruise, so my wife and I have sailed on a variety of cruise lines and ships to many places around the planet. For this 7-night sailing, our daughter, son-in-law, grandchildren (ages 10 and 8), and in-laws joined us.
Our travel agent had arranged TSA Pre-Check boarding for our JetBlue flights, which made travel stress-free and easier. If you travel frequently, the fees for TSA Pre-Check are a no-brainer. We arrived in Fort Lauderdale three days before the ship's departure. We usually arrive early so any flight delays (due to weather or equipment) don't cause us to miss the cruise ship's departure. Experienced travelers know that if you miss the ship's departure, it is the passenger's responsibility (and cost) to catch up with the ship in the next port.
Early arrival in Florida also provided plenty of time to relax poolside at the hotel, explore the departure city, and sample several nearby restaurants. The Crowne Plaza Fort lauderdale Airport/Cruise featured comfortable beds, spacious rooms, and a large, relaxing pool. The main draw for us was the shuttles provided by the hotel both from the airport and to the cruise port.
The boarding process at Port Everglades, the cruise terminal in Fort Lauderdale, was well-organized and easy. We checked our luggage with the porters, and waited for our daughter and her family. When they arrived, we all entered the check-in line, passed through security, and boarded the ship. Our stateroom was ready, so we left our carry-on bags there and explored the ship. We booked an inside stateroom for this sailing, since we expected to spend very little time thee. On prior sailings we've booked outside staterooms (with a larger window) or staterooms with balconies.
The Allure OTS is a mega-ship in the truest definition. At 222,282 tons, it was the largest cruise ship for six years until Royal Caribbean's Harmony of the Seas debuted in May, 2016. Our sailing on July 24 included 6,464 passengers, of which about 1,700 were children under the age of 16. It offers 25 different dining options with a crew of 2,384. Besides the standard dining rooms, the ship offers the Chops Grille American steakhouse, Sabor Taqueria and Tequila Bar, Izumi Hibachi and Sushi, Giovanni's Table Italian restaurant, Starbucks, and a Johnny Rockets hamburger shop.
The ship includes seven "neighborhoods" or areas. Situated indoors and length-wise the cruise ship, the Royal Promenade (Deck 5) features several retail stores, art gallery, a Champagne bar, restaurants, nightclubs with live music, duty-free stores, comedy club, karaoke bar, and the customer service desk. You'll often see children posing for photos with characters from "Shrek," "Madagascar," and other animation films produced by DreamWorks Animation.
The outdoor Boardwalk (Deck 6), modeled after Coney Island amusement area in New York City, features several retail shops, ice cream and pizza, casual-dining options, a merry-go-round, and the AquaTheatre. I've never seen a merry-go-round on a cruise ship before, and I doubt you have either.
The Pool & Sports Zone (Deck 15) features the H20 Zone water park, several swimming pools, several hot-tubs that easily seat 14 persons each, plenty of deck space with umbrellas to enjoy the sun, several bars for adult refreshments, and guest services to get beach towels. Beach towels are free, but the cruise line will charge you if you don't return it. Also on Deck 15 is the full-size basketball court, miniature golf course, two Flow-Rider surf simulators, and an 82-foot long Zip Line. Lessons are available for the surf simulators.
Outfitted with 60 trees and about 12,000 plants, the Central Park (Deck 8) is an outdoor park with recorded birds chirping, upscale dining options, shady spots to relax at, and access to the Rising Tide bar. Like an elevator, this bar for adults moves between decks 5 and 8 on a daily schedule. I've never seen a park before on a cruise ship. It is definitely a must-see neighborhood. Since I practice Tai Chi, I asked if there were classes on board. A crew member replied that a group practiced in Central Park at 6:00 am. I thanked her for the tip, and didn't join that group. I was on vacation and rising early was not a priority.
The Vitality Sea Spa & Fitness Center (Deck 6); far larger than fitness centers on other cruise ships, covered two decks and featured plenty of treadmills and exercise equipment. Like other cruise ships, passengers can get their hair done in the salon for formal dinner nights, or experience a a relaxing massage (e.g., full-body,, detox, hot stone, bamboo, etc.) in the spa. There is easy access from the fitness center to the Jogging Track (2.4 laps = 1 mile). You can run, jog, or walk comfortably out of the wind and in the shade.
A large portion of the ship is dedicated to children and families. This includes activities in the Adventure Ocean day-camp program, the H2O Zone water park, two 43-foot high rock-climbing walls, two Flow-Rider surf simulators, an 82-foot long Zip Line, the merry-go-round, a 3-D movie theater, a miniature golf course, a full-sized basketball court, an ice-skating rink with shows and open skating, and video arcade. The day camp program provides parents with plenty of opportunities for "couple's time."
For adults, there are several nightclubs with adult entertainment, the Solarium and Solarium Bar (decks 15 and 16), the Casino Royale (Deck 4), and numerous upscale dining options. The Allure Of the Seas truly offers plenty of activities for everyone. If you try to do it all, then you'll probably need a vacation to recover from your cruise vacation.
The Allure of the Seas was refurbished in May, 2015. Several shops, public areas, and the WiFI were upgraded. Royal Caribbean's investment showed. My Internet connection was consistently very fast throughout the entire voyage; unlike other ships. If you seek quiet places on the ship (without music, noise or recorded birds chirping), there are several, including the Card Room (Deck 14), Library (Deck 11), and the Solarium (Decks 15 and 16). If you seek a place away from children, the Solarium is a good choice.
Like other Royal Caribbean cruise ships, the next day's activities are listed in the daily Cruise Compass newsletter, delivered each evening to your stateroom. This newsletter is a handy tool. It also lists discounts and sales in the on-board retail stores, hours of operation of the restaurants and dining options, movies in the cinemas, and the live entertainment daily in the theaters and nightclubs.
Royal Caribbean encourages passengers to make your reservations for dining, shows, and nightclub music performances before you sail. This is one of several new trends in cruise vacations. Many people like it. I don't. It used to be that you could arrive early for any show and walk right in. Now, walk-ins must wait until all guests with reservations are seated first. For me, this mandatory reservations system removes the spontaneity and freedom of deciding what to do based upon how you feel at that moment.
Overall, I give the Allure of the Seas excellent marks. The ride was very smooth, and most of the time you didn't know you were at sea on a cruise ship. The ship's layout and venues are well organized, and the crew is very professional. Most of the time, I did not realize I was on a ship with 6,464 passengers. About the only time the ship felt crowded was in the Promenade. When the Promenade was crowded, it looked and felt like any land-based shopping mall between Thanksgiving and Christmas holidays. I like to go on cruises to get away from land-based attractions, not replicate them.
If you have sailed on the Allure of the Seas, what was your experience? Which neighborhood on the ship was your favorite?
" 'How about we partner with Pokemon Go?' -- Said in every office at every agency for every client this morning."
Probably. The augmented-reality (AR) mobile game requires players to travel real-life streets to find and capture digital characters superimposed on locations and displayed on the screens of players' phones. The game's screens also display PokeStops and gyms, locations superimposed on real-life landmarks. The CNN video at the end of this blog post provides a good summary. The Apple iTunes site explains important game details:
"Search far and wide for Pokémon and items: Certain Pokémon appear near their native environment—look for Water-type Pokémon by lakes and oceans. Visit PokéStops, found at interesting places like museums, art installations, historical markers, and monuments, to stock up on Poké Balls and helpful items... As you level up, you’ll be able to catch more-powerful Pokémon to complete your Pokédex. You can add to your collection by hatching Pokémon Eggs based on the distances you walk... Take on Gym battles and defend your Gym: As your Charmander evolves to Charmeleon and then Charizard, you can battle together to defeat a Gym and assign your Pokémon to defend it against all comers."
What do we know so far about the AR game? What has happened since the game's launch? What happens when a mobile fantasy game combines real-life locations? Are non-players affected? What might be the implications for future AR games? I looked for answers, found plenty, and organized my findings into good, bad, and ugly categories -- with apologies to Mr. Leone and Mr. Eastwood.
"... Pokemon Go’s game designers have perfectly executed on the “Hook Model” — a framework for gamification and getting users to come back again and again and again."
Advocates have said that the game has gotten gamers off of their couches (e.g., butts) and out into the real world to get exercise, meet people, and explore locations they probably wouldn't have visited otherwise. Sounds good.
Within the game, PokeStops and gyms are located in publicly-accessible locations, such as theme parks, gardens, and museums. This has increased the sales at some nearby, small businesses. IGN reported on July 21:
"Bok Tower Gardens, a “contemplative garden” and National Historic Landmark located in Lake Wales, Fl, is saturated with PokeStops. The non-profit recorded a 10 to 15 percent increase in ticket sales during the first week of Pokemon Go’s release... So far, the only way to become a PokeStop or gym is to send in a request to Niantic Labs, but it isn't likely to be accepted unless the location is one of cultural significance or in a Pokemon Go deadzone."
"... to connect “Pokemon Go!” with real-world flora and fauna... This interactive, ranger-guided walk will allow visitors to uncover the creatures, both physical and virtual, that can be found within the National Lakeshore. They will learn how these creatures do or do not fit in with the rest of the environment, and what can be done to help them thrive. At the end of the program, visitors will be able to design their own Pokemon. “Trainers” of all ages are welcome."
"Many local Minneapolis businesses have considered, or implemented, special promotions to attract more mobile-gamers. Last week, Sencha Tea Bar in Stadium Village released three special shakes in correspondence with the three color teams of the game — red, yellow and blue — said store manager Josh Suwaratana. Suwaratana said the store does special shakes for other occasions, so the Pokemon shakes weren’t anything out of the ordinary... Sencha is also located next to a Pokestop — a real-life location where players can obtain items in the game. Suwaratana said the proximity to the Pokestop has helped business attract players."
"... I would encourage parents to seize the opportunity for their children to capitalize on this gaming experience while at the park or when running errands. My advice is not to judge this new gaming experience as all bad and in need of limits. Rather let’s embrace a step toward video games and virtual reality that may one day be tailored to inspiring those we love with autism spectrum disorder (ASD) to leave the house and receive points/rewards/tokens for gathering information from other people they encounter in the store, at work, or at a place of leisure. To me that sounds an awful lot like what I have been trying to get them to do by learning social skills in my office each week..."
To focus the world's attention upon the impacts to citizens and children, activists have added Pokemon characters to images from war zones. C/Net reported on July 26 that Khaled Akil, a Syrian artist:
"... has taken Pokemon Go creatures and Photoshopped them into pictures of his war-torn homeland, presenting a stark contrast between the whimsy of the augmented-reality game and the sobering day-to-day realities of war... In one image, a young boy walks his bike through a street lined by bombed-out buildings, a Vaporeon by his side. In another, a Pikachu rests on a block of rubble next to a burning car... the activist group Revolutionary Forces of Syria Media Office has been tweeting poignant photos of kids holding up printouts of popular Pokemon creatures, along with their locations, which are identified as being near areas of heavy fighting, and the words 'save me'..."
To view photos, follow the links in the C/Net article to Akil's website and Instagram account.
"During game play, please be aware of your surroundings and play safely. You agree that your use of the App and play of the game is at your own risk, and it is your responsibility to maintain such health, liability, hazard, personal injury, medical, life, and other insurance policies as you deem reasonably necessary for any injuries that you may incur while using the Services. You also agree not to use the App to violate any applicable law, rule, or regulation (including but not limited to the laws of trespass) or the Trainer Guidelines, and you agree not to encourage or enable any other individual to violate any applicable law, rule, or regulation or the Trainer Guidelines. Without limiting the foregoing, you agree that in conjunction with your use of the App you will not inflict emotional distress on other people, will not humiliate other people (publicly or otherwise), will not assault or threaten other people, will not enter onto private property without permission, will not impersonate any other person or misrepresent your affiliation, title, or authority, and will not otherwise engage in any activity that may result in injury, death, property damage, and/or liability of any kind."
The "Conduct, General Prohibitions, and Niantic’s Enforcement Rights" section of the policy also lists the responsibilities of players, including players will not:
"... trespass, or in any manner attempt to gain or gain access to any property or location where you do not have a right or permission to be..."
So, it is important for players to know their responsibilities. Do they? Keep reading.
"Members of the East Providence Police Department said “Pokemon Go” has drawn huge crowds of people to local parks after hours... Officers say they have responded to several calls about the crowds. “They are very peaceful, they’re not causing problems, but it is in a public area – in public parks – and people who live in those areas do deserve to have their rest at night,” said Maj. William Nebus of the East Providence Police Department. “Our parks do close at 9 p.m. and just to have 200 people lurking in overnight hours is not peaceful to the residents.”
Law enforcement in Michigan ticketed players with misdemeanors after late-night, 12:30 a.m. game play. Nearby property owners have found players intrusive. There are two implications. First, it's important for players to understand and comply with local town ordinances and hour restrictions. Second, taxpayers will likely absorb the additional costs of park maintenance, clean-up, and law enforcement patrols to address the increased foot traffic in local parks.
"Your account was permanently terminated for violations of the Pokémon GO Terms of Service. This includes, but is not limited to: falsifying your location, using emulators, modified or unofficial software and/or accessing Pokémon GO clients or backends in an unauthorized manner including through the use of third party software."
"Security researcher Adam Reeve noted that when some users sign into Pokemon Go through Google on Apple devices, they effectively give the game and its developer full access to their Google account; this means, that at least in theory, Niantic... can access players' Gmail-based email, Google Drive based files, photos and videos stored in Google Photos, and any other content within their Google accounts. From a technical perspective, Niantic could potentially send emails on your behalf, or copy and distribute your photos. This is obviously concerning. Perhaps even scarier - and more eye-opening - is that users are accepting such permissions en masse without regard for the risks."
The Offensive Privacy blog offered privacy tips given the game's usage of smartphone cameras:
"While it's a bit outlandish to think that Niantic collects the video streams from every device, it is always a possibility that cannot be completely ruled out. This means anything your camera sees could, in theory, be stored by Niantic... I suggest some common sense tactics that apply to all cameras and video streams when using the AR mode of the game: 1) Never allow the camera to see personal ID such as your license, passport, or other sensitive document; 2) Never let the camera see a license plate or government building. This is especially true for those working in high-security environments; and 3) Avoid letting the camera see street signs, your house, house numbers, etc. It's also possible that metadata could be embedded in the image and made available if the image is shared publicly..."
Regular readers of this blog are already familiar with the privacy issues associated with metadata collection. Some players may be surprised that tips to maintain privacy while playing requires effort.
One measure of popularity are parodies. There is a porn parody of the game titled, "Poke-mon Ho!" Depending upon your lifestyle, you might categorize this as "good." Yes, the parody reportedly is NSFW. No, I haven't seen it.
"The United States Holocaust Memorial Museum and Arlington National Cemetery, both in Washington, DC area, have both issued appeals for players to avoid hunting Pokemon on their sites. "Playing Pokemon Go in a memorial dedicated to the victims of Nazism is extremely inappropriate," said Andy Hollinger, director of communications at the United States Holocaust Memorial Museum in Washington, D.C., in a statement sent to CNNMoney. "We are attempting to have the Museum removed from the game," the statement said... Pokemon Go has a link set up for people to report sensitive locations and contact on its website... According to a statement from The Pokemon Company International and Niantic -- the creators of Pokemon Go -- Pokestops and gyms in the app are found at publicly accessible places. That includes historical markers, public art installations, museums, monuments -- and apparently churches."
I see two problems with the approach the game's developers used. First, the approach seems to have treated all public spaces the same, without considering the unique needs of cemeteries, memorials, and similar places. Game-play isn't appropriate everywhere. Second, Niantic's approach automatically included real-life locations as PokeStops and gyms without first obtaining the property owners' permissions. This approach places the burden on property owners (who aren't players nor participants) to opt-out of the game. Not good. Maybe this was a slick attempt to force property owners to participate. Not good.
"Jeffrey Marder, a resident of West Orange, N.J., found in the days after the release of the successful augmented reality game Pokémon Go, that strangers, phone in hand, had begun lingering outside his home. At least five of them knocked on Marder’s door and asked for access to his backyard to catch and add to their virtual collections of the Pokémon images, superimposed over the real world, that the game developer had placed at the residence without his permission."
"Scott Dodich and Jayme Gotts-Dodich, of St. Clair Shores, filed a class action lawsuit against Niantic, The Pokemon Company and Nintendo... The couple lives on a private cul-de-sac and alleges that over several weeks, Pokemon Go players parked their vehicles on their street and blocked driveways. The couple also alleges that players trespassed on lawns, trampled landscaping and peered into windows. The complaint also alleges that when Jayme Gotts-Dodich asked a Pokemon Go player to leave her property, the player told her to “shut up b****, or else... The suit alleges that the intentional, unauthorized placement of Pokestops and Pokemon gyms on or near private property constitutes a continuing invasion of use and enjoyment. Due to the ignored repeated requests for removal, the couple believes that Niantic is liable for nuisance and that all defendants have been unjustly enriched.”
If a disagreement arises between Niantic and a player, that may not be resolved in court in front of a jury of the gamer's peers. The Niantic Terms of Service policy strips gamers of that right:
"ARBITRATION NOTICE: EXCEPT IF YOU OPT OUT AND EXCEPT FOR CERTAIN TYPES OF DISPUTES DESCRIBED IN THE “AGREEMENT TO ARBITRATE” SECTION BELOW, YOU AGREE THAT DISPUTES BETWEEN YOU AND NIANTIC WILL BE RESOLVED BY BINDING, INDIVIDUAL ARBITRATION, AND YOU ARE WAIVING YOUR RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS ACTION OR REPRESENTATIVE PROCEEDING."
"Pokemon Go has added a new layer of excitement to a day at Disney World for those who seek that variety of enchantment. Disney is benefiting from the craze, even as non-players shake their heads while swerving around distracted gamers. This also could and should be just the beginning. It's only a matter of time before it rolls out its own augmented-reality app... A Disney app likely also wouldn't include a Pokemon-like battle element, at least not in terms of pitting Pluto against Yoda in combat. However, the Disney gym equivalent could be mini-game stations offering everything from speed Disney trivia matches to Virtual Magic Kingdom-type competitions... There are more than 200 Disney Store locations scattered across North America, and more than 120 overseas. These stores can also serve as character-collecting hubs, giving players a local connection for special events. It would also keep interest active outside of theme park visits..."
Recently, some friends and I were discussing the wisdom of getting your news from social networking websites (e.g., Facebook, Twitter, Snapchat, Youtube, LinkedIn, etc.) instead of directly from news media sites. Apparently, many consumers get their news from such sites.
The Pew Research Center reported that most adults in the United States, 62 percent, get their news from social networking sites. The corresponding statistic in 2012 was 49 percent. Fewer social media site users get their news from other platforms: local television (46 percent), cable TV (31 percent), nightly network TV (30 percent), news websites/apps (28 percent), radio (25 percent), and print newspapers (20 percent).
Pew analyzed which social networking sites were used the most for news, and whether consumers used multiple sites to obtain news. The Pew Research Center found:
"Two-thirds of Facebook users (66 percent) get news on the site, nearly six-in-ten Twitter users (59 percent) get news on Twitter, and seven-in-ten Reddit users get news on that platform. On Tumblr, the figure sits at 31 percent..."
The corresponding statistics are 23 percent for Instagram, 21 percent for Youtube, 19 percent for LinkedIn, and 17 percent at Snapchat. The implications:
"Facebook is by far the largest social networking site, reaching 67% of U.S. adults. The two-thirds of Facebook users who get news there, then, amount to 44% of the general population. YouTube has the next greatest reach in terms of general usage, at 48% of U.S. adults. But only about a fifth of its users get news there, which amounts to 10% of the adult population. That puts it on par with Twitter, which has a smaller user base (16% of U.S. adults) but a larger portion getting news there."
About audience overlap, Pew found that most people (64 percent) get their news from one social media site. 26 percent get their news from two social media sites, and 10 percent get their news from three social media sites. Pew also found that more users at Reddit, Twitter, and LinkedIn seek out news versus stumbling across it by accident:
Percent of news users of each site who mostly get news online
Social Networking Site
While doing other things
Because they're looking for it
Who are the news users at the five largest social sites with news users? The users vary by site:
"... while there is some crossover, each site appeals to a somewhat different group. Instagram news consumers stand out from other groups as more likely to be non-white, young and, for all but Facebook, female. LinkedIn news consumers are more likely to have a college degree than news users of the other four platforms; Twitter news users are the second most likely."
The demographic data:
Some of you are probably wondering about Google+ and Pinterest. Pew removed three social media sites because:
The survey was conducted from January 12 to February 8, 2016 and included 4,654 respondents (4,339 by web and 315 by mail). The methodology included a randomly-selected subset of U.S. adults (6,301 total web-based persons and 474 total mail persons.
Today is Safer Internet Day (SID) #SID2016. This event occurs every year in February to promote safer and more responsible use of online technology and mobile phones, especially among children. This year's theme is:
"Play your part for a better Internet"
There are events in 100 countries worldwide. The European Commission’s Safer Internet Programme started the event, which has continued under the Connecting Europe Facility (CEF). This is the 13th annual event. According to its press release:
"Last year’s celebrations saw more than 19,000 schools and 28 million people involved in SID actions across Europe, while over 60 million people were reached worldwide..."
Hans Martens, Digital Citizenship Programme Manager at European Schoolnet and Coordinator of the Insafe Network said:
“The theme of ‘Play your part for a better internet’ truly reflects how stakeholders from across the world can and should work together to build a trusted digital environment for all. This approach is at the core of the Better Internet for Kids agenda, and we look forward to seeing many exciting onitiatives and collaborations, both on the day of SID itself and beyond."
Recently, a friend posted this message on Facebook:
"I need advice. I looked in my Facebook notifications and received a notification that someone I don't even know shared my post. I looked at the post on this person's timeline and it has a picture of my female cousin and it has me tagged with her and a caption that she is my wifey with a little wedding ring icon. What??!! What's going on?"
My response with advice:
Review your list of friends and delete people you don't know,
Review the privacy settings on your account. You can set them to provide notice when anyone tags you in a photo. Along with that notice you can approve or decline each photo-tag request,
Go to the existing, offending photos and remove that tag with your name,
Contact offline the person that tagged you in the photo to verify that it was indeed that person. Sometimes, spammers or criminals create bogus accounts pretending to be a friend so they can access your account and steal personal information.
When you contact that person offline, you can ask them not to tag you in any future photos. You have that right. It's your image. If he/she complies, fine. If not, delete them from your friends list,
Make sure all of your posts have the "Friends Only" setting. Facebook will often inherit the "Public" setting on re-posts, which opens you to spammers, criminals, and trolls,
Don't accept new Friend Requests from people you don't know. Finally,
Realize that your information on Facebook is only secure as your friend with the weakest security settings in his/her profile, or none. Those persons probably violate #6.
So, maintaining a presence with privacy on social networking sites requires diligence. If you're not up to the task or don't want to do it, then don't join that social networking site (or delete your account on an existing site). What would you recommend?
At a recent cyber-security conference at New York University, a MasterCard executive raised concerns about the WiFi-enabled Barbie doll. The New York Post newspaper reported:
"The chief executive of MasterCard on Friday singled out the $75 Mattel doll as a security threat — the second time the tech-smart Barbie has run into trouble. Ajay Banga said hackers can gain control of Barbie’s voice and then “talk” to a child. The hackers can then win the confidence of the kid and, under certain circumstance, attempt to gain access to your home..."
Regular readers of this blog are familiar with the security issues from Internet-connected toys, such as this doll, which also contain a voice-recognition interfaces. As Banga accurately emphasized, a criminal can hack the toy and ask the child what valuables the family owns, plus when the home will be vacant. Adolescents and toddlers are too young to understand security concepts, what not to disclose to strangers, and when a toy asks inappropriate questions.
Think of it this way, criminals regularly use phone spam to trick adults into revealing sensitive personal and financial information. It would probably be easier to trick young children. With Internet-connected devices in homes, criminals can easily bypass do-not-call registries.
Banga also mentioned that MasterCard is a favorite target of hackers, with 15,000 attempted hacks daily. That reinforces the observation that criminals go where the money is. The newspaper also reported:
"Several of the most prominent names in cybersecurity said during the conference that most people aren’t aware of the growing number of cybersecurity threats that they’re exposed to as manufacturers keep making products that hook up to the Internet. One of the biggest vulnerabilities is the so-called “Internet of things” — everything from TVs to refrigerators to vending machines that automatically connect to the Internet, and then transmit data to another source."
Many or most of these devices have hands-free voice controls. That feature provides a huge convenience, but along with it comes the privacy threat that it can (or does) record everything you say... whether you intend it for the device or not.
"You may never know for sure. At best, you can hope the company keeps its promises on privacy. More important, you have to trust that its computer systems are really secure, or those promises are suddenly worthless. That part is increasingly difficult to guarantee — or believe — as hacking becomes routine."
"Every technological benefit comes with a cost in the form of a threat to privacy. Yet not paying that price has its own cost: an inability to participate in some of technology's greater achievements."
There has to be a better way. Consumers should not have a to choose between giving up privacy in order to use smart devices versus living under a rock without smart devices to maintain privacy. What are your opinions?
A security researcher found online a database containing the sensitive information of customers of the Hello Kitty gaming site. Just before the Christmas holiday, C|Net reported:
"Personal information for fans who connect through SanrioTown.com has been sitting openly viewable on the Internet and easily accessible with the click of a mouse, no hack required... SanrioTown.com, designed for fans of Sanrio characters like Hello Kitty, hosts all the accounts for players of a popular game called Hello Kitty Online."
C|Net also reported that the security researcher:
"... showed CNET a sample of the records he saw, which includes a list of usernames, scrambled up passwords, first and last names, genders, birth dates and answers to security questions like "What is your favorite food." In the random sample of 15 records, two appeared to be of minors. Sanrio declined to verify whether the data listed in the sample was from its database. Vickery found the database, he said, while looking for unprotected information on the Internet by searching a website that can find data stored in the cloud."
"Sanrio Digital, a subsidiary of the Japanese owner of “Hello Kitty,” a popular children’s brand, told Reuters on Tuesday that it patched a security glitch that had affected one of its databases being tipped off by Chris Vickery, a U.S.-based researcher who helps identify and fix vulnerable computer systems... Sanrio has insisted that evidence has so far failed to suggest that anyone other than Mr. Vickery had accessed the database with authorization..."
Reportedly, the breach exposed the following data elements: full names, birthdays, genders, email addresses and related information about 3.3 million account holders. That included information about 186,261 persons under the age of 18. Payment information (e.g., credit cards) was not exposed, according to the SanrioTown security statement.
Two items about this breach need to be highlighted:
The operative phrase in the company's statement is, "that evidence so far..." More evidence may surface later; and
The company did not discover its own database sitting open, unprotected in the wild. An external security researcher found it. That fact does not bode well for the company's security team and data security processes.
In its FAQ page, VTech confirmed that on November 14 hackers accessed its customer database:
"... on our Learning Lodge app store customer database and Kid Connect servers. Learning Lodge allows our customers to download apps, learning games, e-books and other educational content to their VTech products. Kid Connect allows parents using a smartphone app to chat with their kids using a VTech tablet."
The company learned of the data breach on November 24 when a journalist inquired. During its current breach investigation, During its breach investigation, Vtech has temporarily suspended operations at Learning Lodge, the Kid Connect network, and a dozen websites including both PlanetVtech and VSmileLink sites in the US, France, Germany, United Kingdom, and Spain. Vtech's customer data includes the USA, Canada, United Kingdom, Ireland, France, Germany, Spain, Belgium, the Netherlands, Denmark, Luxembourg, Latin America, Hong Kong, China, Australia and New Zealand.
The number of persons affected by the breach:
"In total 4,854,209 customer (parent) accounts and 6,368,509 related kid profiles worldwide are affected, which includes approximately 1.2 million Kid Connect parent accounts. In addition, there are 235,708 parent and 227,705 kids accounts in PlanetVTech. Kid profiles unlike account profiles only include name, gender and birthdate."
The VTech FAQ page also listed the number of breach victims by country. Parent accounts include the following data elements: name, e-mail address, security question and answer for password retrieval, IP address, mailing address, download history, and encrypted password. VTech's customer database does not contain credit card payment information, nor Social Security and similar identification information.
VTech describes itself as a global leader in electronic learning products for children and the world's largest manufacturer of cordless phones. Founded in 1976, VTech is headquartered in Hong Kong and has operations in 11 countries including manufacturing facilities in China. It employs about 30,000 employees, with 1,500 research and development professionals in Canada, Germany, Hong Kong, and China.
Even though customers' passwords were encrypted, VTech advised breach victims to change their passwords anyway, as skilled hackers may break the encryption. This is critical if breach victims used the same passwords, security questions, and security answers at other online sites.
This is not good. Whatever security detection software VTech used needs to be upgraded or replaced. A company should not learn about a breach from a journalist. The data elements stolen are sufficient for criminals to impersonate data breach victims, attempt to break into victims' other online accounts (e.g., banking), and send spam e-mail messages.
Do you or your children use VTech apps, games, or e-books? If so, what breach notifications have you received?
The holiday shopping season is here. Experts estimate that consumers will spend about $83 billion. Everyone wants to shop safely and avoid both identity theft and fraud. The California Attorney General's office issued several safe-shopping tips for consumers that are applicable everywhere and not only in California. Some of the items were already covered in this blog, so I added links.
Shop at secure websites. Look for https in the website address, or for the yellow lock icon
Don't shop online at public WiFi hotspots, such as coffee shops. This can put at risk your payment information (e.g., bank account, credit/debit card numbers, etc.). If you must use a public WiFi hotspot, use encryption software on your mobile device.
Do not send personal and payment information in e-mail messages. Legitimate companies won't ask you to do this, since it is an insecure way of transmitting information. Learn to spot package delivery scams.
Use reputable websites when booking travel or lodging for trips. However, scammers also insert listings on vacation websites. If the price is too good to be true, it usually is. Learn to spot vacation payment scams.
If you receive text messages on your phone claiming you have won a prize or gift card, do not click on the link in the message. It probably is a scam and may install a virus on your phone. E-mail scams are common. Learn to spot phishing e-mails. Be wary of e-mails from persons claiming to be a shipping company. These e-mail message often contain attached files that contain computer viruses. Do not open attached files from strangers.
Consider using a two-step process to protect your email account and sensitive personal information. For example, after inputting your password, you will then receive a text on your phone, that provides a one-time-use code to sign into your e-mail account. Your e-mail provider has instructions about how to set this up.
Thieves use handheld scanners and counterfeit credit cards to use gift cards that they do not actually have. Only buy gift cards that are kept behind the store’s customer service counter or activated upon checkout. Before buying the card ask for it to be scanned to show that it is fully valued.
Package theft is happening more frequently. If you do not have a secure area for delivery companies to leave packages, consider requiring a signature for packages, or have your packages held for pickup at a nearby shipping center.
Review your bank and credit card statements frequently for fraudulent transactions. Contact your bank or card issuers immediately if you see unusual or suspicious transactions.
Parents and grandparents should be wary of phone calls, e-mails, and social networking posts by scam artists pretending to be a child, friend, or relative stuck in an emergency abroad and needing cash immediately. Scammers try to get the victim to wire cash or disclose sensitive personal and financial information. Don't do this. Before taking any action, verify the health or status of the child, friend, or relative abroad.