Asset Protection BLOG - Mark Nestmann

Stanford Debacle Proves Wisdom of Off-Balance Sheet Investments

One of my standing recommendations to clients is that they hold investments traded on a securities exchange, rather than on the balance sheet of a financial institution. This strategy largely avoids the possibility of loss if the financial institution becomes insolvent, although it does not eliminate the market risk for the securities investment.

Basically, the reasoning here is that you don't want your investments to be a hostage to the safety (or lack thereof) of your bank or brokerage.  So, for instance, instead of holding short-term investments in a brokerage's money market fund, consider holding them in a short-term Treasury bill fund traded on the NYSE or other exchange. 

This strategy paid off big-time for investors who maintained brokerage accounts with Stanford Private Wealth Management.  This company is now under investigation in an alleged US$8 billion Ponzi scheme masterminded by its founder, R. Allen Stanford. 

Last month, a U.S. court froze 32,000 investor brokerage accounts with Stanford when the SEC sued Stanford, two associates and three affiliated companies.  Most of these accounts (more than 28,000) were quickly unfrozen.  However, on March 12, a federal judge in Dallas indefinitely extended the freeze on more than US$1 billion in about 4,000 remaining Stanford accounts.  To recover these monies, the receiver (i.e., the official appointed by the court to recover assets to repay victims of the Ponzi scheme) may require investors to submit proof that their funds aren't tainted by fraudulent activity.

Since many of these 4,000 accounts belong to Stanford employees, this proposal is not unreasonable.  However, not all the account-holders are Stanford employees.  Many of them merely purchased high-yield certificates of deposit throughAntigua-based Stanford International Bank.  These CDs aren't traded on any exchange and appear to be part of the bank's balance sheet.  Although we don't know how things will shake out in court, the account-holders who purchased these CDs may well be considered unsecured creditors of the bank.  They'll need to wait in line with all other unsecured creditors to divvy up whatever proceeds the receiver can recover.  It's entirely possible they'll lose close to 100% of their investment.

The lesson should be clear.  Particularly in these times of extreme financial uncertainty, avoid keeping significant investments on the balance sheet of any financial institution, unless you're very confident of long-term solvency. 

Copyright © 2009 by Mark Nestmann

Spy on Yourself … for the Children

Nothing is "too much" when it comes to protecting our children.  Especially your privacy.

Republicans in the U.S. Senate and House have introduced companion bills that would force Internet Service providers (ISPs) to retain user data from every subscriber for up to two years.  Key congressional Democrats and the Obama administration appear to endorse their proposal.  And it's all intended, supposedly, to protect children from sexual exploitation by adults.

What's to be recorded?  Everything, according to the proposed "Internet Stopping Adults Facilitating the Exploitation of Today's Youth Act," or Internet Safety Act.  For starters, your e-mail messages, your Web browsing records, and most likely, the contents of any telephone calls you make or receive over the Internet.

And it's not just commercial ISPs that will be affected.  Iif you have a wi-fi router at home, you're supposed to surveil yourself.  Hotels, libraries, universities, local coffee shops—indeed anyone offering Internet access anywhere in the United States—will need to keep and maintain these records.

Consider for a moment what these records might contain.  Every day, billions of spam messages promoting pornographic websites are sent to millions of email addresses—perhaps yours.  Naturally, the Internet Safety Act requires that your ISP save these messages (or you, if you have a wireless Internet connection).  In addition, many Internet pages display pop-up messages that contain pornographic images.  You must save those images, too, even if you have absolutely zero interest in child pornography, or any kind of pornography.

Under existing law, if any of these images are of people in nude or sexually suggestive poses who appear to be under the age of 18, you can be arrested for possession of child pornography. 

In other words, the Internet Safety Act would, by its very purpose, open the door for virtually anyone who uses the Internet to be arrested on child porn charges.  However, I suspect that the data won't be used to fight child pornography as much as it's used in other types of investigations.

But, incredibly, that's not the worst part of this bill.  The worst part is that the stored data will be an identify thief's pipe dream.  Consider what you'll have to do once this law comes into effect if you have a home or office network.  First, you'll need to install some very expensive storage devices that can store two years of data for everything you do online.  You won't have access to the stored data—after all, you might delete it, and that would be illegal. 

So now you have millions of Americans possessing at home (or perhaps in an online repository) data reflecting everything they've done online for the last two years.  Your user IDs, passwords, and other confidential data will be there for the taking by any hacker smart enough to get past whatever security measures are put in place.  And don't think those measures will be impenetrable.  If hackers can clone supposedly "ultra-secure" RFID passports (which they have done already), how safe do you think your data will be?

But the most laughable aspect of this proposal is how easy it will be to evade it.  If you take the simple precaution of subscribing to a "virtual private network" (VPN) your ISP will see only an encrypted data stream flowing through your online connection.  So, I anticipate that a companion bill to the Internet Safety Act will force that VPNs turn over their encryption keys over to the Department of Justice for "safekeeping."  That will naturally cause anyone seeking privacy to subscribe to non-U.S. VPNs, although the Obama administration apparently wants to extend these requirements globally.

If they achieve this goal, the only way left to communicate privately may be to do what I did as a child—string two tin cans together with a wire. 

"Hello, can you hear me?"

Copyright © 2009 by Mark Nestmann

Surveillance Self-Defense: Who's Watching You, and What to Do About It

Whether you're browsing the Internet, sending or receiving text messages, or chatting on your cell phone, information you may think is private very often is not.

That's why it's important to educate yourself on counter-surveillance strategies to reclaim your electronic privacy.  And now, the Electronic Frontier Foundation (EFF) has created its Surveillance Self-Defense project—an online how-to guide for protecting your private data against government spying. You can read about the project at http://ssd.eff.org.

I view myself as fairly knowledgeable about electronic surveillance threats, but I learned a great deal I didn't know when I reviewed the guide.  For instance, you probably have heard of "cookies"—those bits of code that record your use of a Web site and your user preferences.  Modern Web browsers give you ability to discard cookies periodically or even every time you close the browser. 

However, new "super-cookies" can't be deleted as easily.  For instance, the Firefox Web browser has a feature called "DOM storage" that tracks your visits to Web sites using this technology.  Surveillance Self-Defense tells you how to turn this feature off so that hackers, government investigators--or anyone else--can't track your movements on the Internet.

There's lots of other good stuff in Surveillance Self-Defense on subjects ranging from encryption to securing instant messages.  I recommend that you read Surveillance Self-Defense and take its suggestions to heart.  Doing so will give the government—and anyone else—a lot less information to search, seize, subpoena or spy upon.

Copyright © 2009 by Mark Nestmann

AMEX: We Can Spam You and Make You Pay for It

Do you carry an American Express card?  If you do, you need to know about new new terms of service effective April 2, 2009 under which AMEX can try to contact you at any phone number even remotely connected with your account.

Here's an excerpt:

"You authorize us to call or send a text message to you at any number you give us or from which you call us, including mobile phones. You authorize us to make such calls using automatic telephone dialing systems for any lawful purpose, including but not limited to: suspected fraud or identity theft; Account transactions or servicing; offers of American Express products and services; and collecting on your Account.  You authorize us to place prerecorded calls in connection with the status of your account, or security and identity theft matters.  You agree to pay any fees or charges you incur for incoming calls or text messages from us without reimbursement."

If you don't accept these new conditions, you need to contact AMEX immediately and cancel your account.  When I called AMEX to inquire about the new policy, a customer service representative told me that I could opt out of any marketing-related phone communication under the new policy. 

However, opting out isn't legally binding, although if you decide not to cancel your AMEX account, I recommend you opt out of as many types of communications as possible.  Otherwise, AMEX can call you anytime, day or night, with pre-recorded sales pitches, text message spam, or for any other reason. And what happens if someone steals your cell phone and a phone or text message arrives broadcasting your personal information to the thief?  That's an invitation to disaster. 

Plus, if AMEX calls or texts you on a cell phone, you may be paying to listen to their sales pitch.  If you travel frequently on an expensive international roaming rate, you could easily pay several dollars each time the company tries to contact you.

Then there's the question of having AMEX contact you at any number from which you call.  That means if you contact AMEX from a phone owned by a friend, family member, or business associate, the company can spam that number, too. 

I'm a consultant, and I've toyed with the idea of offering clients a "hot line" that they could use to contact me anytime, day or night, in an emergency.  If I offered this service, I would probably sell it for thousands of dollars per year.  Yet, AMEX claims the right to do the same thing, without paying anything!

Hopefully, if enough people complain to AMEX, the company will reverse this policy.  At a minimum, AMEX should modify the policy to make clear that cardholders have a clear option to opt-out of all but emergency contact by a human being—not a prerecorded message—in case of suspected credit card fraud.

Copyright © 2009 by Mark Nestmann

Don't Count on Caller ID Blocking to Protect Your Privacy

A prevailing feature of the ongoing War on Privacy is a technological game of leapfrog.  A technical innovation that protects privacy (or reduces it) leads to a countermeasure to temporarily restore equilibrium.  Then another innovation comes along, and the cycle repeats. 

Such is the story of caller ID, a technology that originated in the early 1990s.  From the outset, you could shield your phone number on a call recipient's caller ID screen (at least in the United States) by dialing *67 before you dialed.  Alternatively, you could ask your phone carrier for caller ID blocking for all outgoing calls.

Naturally, there were exceptions.  Caller ID doesn't block calls to 800 numbers, because the recipient pays for the calls.  It doesn't work for 900 numbers, either.  And apparently, calls to law enforcement and other emergency services (e.g. 911 calls) aren't blocked, either.   

Privacy advocates didn't like caller ID for obvious reasons.  Advocates for victims of domestic violence insisted that caller ID blocking be made freely available.  Thanks to their efforts, it was.

On the other hand, some people didn't want to receive calls they couldn't identify (e.g., from telemarketers, and old flame, or whoever).  So telephone companies began to offer "anonymous call rejection" services.  If a call comes in without a caller ID, the call originator must unblock caller ID to complete it. 

The next step in this technological game of leapfrog came when caller ID "spoofing" services sprang up.  These Internet-based services allow privacy seekers to assume the identity of another caller.  For instance, you could make it appear that your call is originating from the White House, the FBI, or anyone else.  Whatever number you tell the spoofing service to insert is what appears on the recipient's caller ID display.

The latest innovation threatens to make caller ID blocking obsolete.  A new service called TrapCall (http://www.trapcall.com) allows cell phone users to unmask blocked caller ID on incoming calls.  You can obtain the caller's phone number—and in some cases their name and billing address as well. 

The basic service is free, although it currently works only with AT&T and T-Mobile subscribers in the United States. It works by exploiting the fact that calls to 800 numbers aren't anonymous.  So when you receive a blocked call on your TrapCall-enabled cell phone, it's automatically routed to an 800 number and back to you, in a matter of seconds.  The caller originating the blocked call only hears the phone ringing—there is no clue you're unmasking his or her identity.

For the moment, the only way I know of to reliably defeat TrapCall is to use a caller ID spoofing service—which one of TrapCall's affiliates, SpoofCard (http://www.spoofcard.com) will gladly provide.  Or you can make your call from a payphone—or borrow someone else's phone. 

Perhaps someone will come along with another technology to defeat caller ID unblocking services like TrapCall.  But until that happens, before you pick up the phone, ask yourself if you're willing to have the recipient of your call knowing not only your phone number, but also your name, and where you live.

Copyright © 2009 by Mark Nestmann

The State versus the Internet: Kentucky Starts a Trade War

There's a war simmering, right now, that you may not have heard about.  The object of the war is control of the Internet.

In some ways, this war is similar to the deceitful "harmful tax competition" campaign that industrialized nations have been conducting against offshore jurisdictions for more than a decade.  It involves the same protagonists: industrialized nations versus developing countries.  And one of the opening salvos of this war is occurring, of all places, in a Kentucky courtroom.

Kentucky is trying to force 141 Internet gaming sites, none of them based in the United States (much less Kentucky) to block access to Kentucky users, or to relinquish control of their domain names.  The state alleges, among other things, that online gaming drains money from horse racing, a key source of tax dollars.  Following a hearing last September, a state judge ordered the domain names to be transferred to the state.  That decision is now under appeal.

Many of the sites have already been transferred to the state or are barred from being transferred to another owner.  Other sites have informed users based in Kentucky they will no longer be able to use the site.

Internet gambling is no doubt controversial, but that's not the point.  Kentucky has fired the opening shot in a trade war against the Internet.  It's been able to seize the property of dozens of non-U.S., non-Kentucky companies because many of the domain names are registered in the United States.

What's more, there's no reason to think that this trade war will be limited to Internet gambling.  The Internet is the fastest growing segment of the global economy.  In just the past four years, global Internet sales have exploded from US$87.5 billion (2004) to an estimated US$204 billion (2008). 

Given this track record, it should come as no surprise that governments want to shut down competition to local bricks-and-mortar businesses. That's particularly true given the state of the global economy.  In the United States alone, more than 75,000 major retail locations are expected to shut down in 2009.  Many will never reopen—the businesses that operated there will increasingly exist only in cyberspace.

If you're an Internet entrepreneur, you've chosen to be involved with what may be the only fundamentally healthy aspect of the global economy.  But if you offer a product or service that can be construed to compete with a bricks-and-mortar company in an industrialized country, expect to be attacked

To deal with these attacks:

• Register your domain name outside any major industrialized country. 
• Set up backup servers outside major industrialized countries. 
• Be prepared for court challenges from governments, such as that of Kentucky, to steal your intellectual property (IP).

Finally—if your Internet business is successful—you should take steps to transfer the ownership of your IP to a suitable offshore structure, if you haven't already done so.  That way, when the Kentuckys of the world come after your Web site, you'll no longer own it the most valuable part of it.  That may not make  bureaucrats very happy, but it will help insure that you can continue operating online. 

Copyright © 2009 by Mark Nestmann

You Have Near-Zero Expectation of Privacy in Your Cell Phone Records [Part II]

In my last blog entry, I explained how a series of court decisions has virtually eliminated legal protection for information in your cell phone.  If you're arrested for even the most trivial offense, police may inspect your calling records, address book, text messages, photos, video files, Web browsing records, and e-mail messages—all without a warrant.  Any information they find can be used against you in a subsequent criminal case.

What can you do to protect yourself?  First, if you can get along without a cell phones or other portable electronic devices, by all means do so.  If you need to carry a cell phone, be sure to activate the password feature.  In some cases, this may create a legal expectation of privacy that prevents a warrantless search.  It may also prevent someone who steals your cell phone from being able to use it or retrieve data from it.

Also, use only the features you really need.  In my case, that means I use my cell phone only to makes and receive calls.  I don't use it for text messaging, to take photos, to send e-mail, or to browse the Internet.  And I delete all calling records regularly.

But even this may not be enough.  A modern cell phone is really a miniature personal computer.  And just like a personal computer, data you delete on your cell phone can be recovered until it’s overwritten.  To protect yourself, periodically reformat your cell phone to make it impossible for anyone to retrieve "not quite deleted" data.  To learn more, click here.

With cell phones becoming ever more sophisticated, the risk of your data being compromised will only increase in the future.  Protect yourself now, not later!

Copyright © 2008 by Mark Nestmann

You Have Near-Zero Expectation of Privacy in Your Cell Phone Records [Part I]

If you think that any of the information in your cell phone is private, think again.  It's not.

The calling records on your cell phone have "no expectation of privacy," according to a court decision issued by a federal court in Kansas.  And under the court's reasoning, it's possible that other data stored on modern cell phones have no expectation of privacy, either.

In the Kansas case, police arrested a criminal suspect and took him into custody.  They seized his cell phone, and without obtaining a warrant, searched its phone book directory, the recent calls directory, and the picture and video file directory.  While the suspect had no information in the picture and video file directory, police recorded five names in the phone directory and 20 telephone numbers in the recent calls directory.  Prosecutors used that information against the defendant in a subsequent criminal proceeding, and the court upheld its use.

Several factors converged to produce this legal result.  Under the "search incident to arrest doctrine," the Supreme Court has held that police can search someone they are arresting.  Police may open any "containers" the person being arrested has in their pockets or otherwise is carrying.  This is true even if no probable cause exists that the containers contain anything illegal.  In the Kansas case, the "container" was the suspect's cell phone.

The Supreme Court has also declared that you have no expectation of privacy in the telephone numbers you dial.  When you dial a telephone number, you must reveal that number to your telephone company.  Since you voluntarily convey that information, you assume the risk that it might be revealed to police.  In the Kansas case, the dialing records included not only outgoing calls, but also incoming and missed calls.  In addition, police didn't obtain the records from the telephone company or incident to a search warrant, but from the phone itself.  Nonetheless, the court declared the search legal.

What about other data on cell phones?  If a cell phone is truly a "container," police can search and retrieve any information on it incident to your arrest for any offense whatsoever—even a minor traffic violation.  There is no expectation of privacy for any of your data.  Your address book, your text messages, your photos, your video files, your Web browsing records, and your e-mail messages are all open to warrantless inspection.  Any information found there can be used against you in a subsequent criminal case.

If you think this is deplorable, I share your outrage.  Fortunately, not all courts agree with the decision of the federal court in Kansas, but if you're arrested, and have your cell phone with you, be prepared for police to use any information they find on it against you. 

Copyright © 2008 by Mark Nestmann

Hackers Find More Security Flaws in Internet Explorer

The Internet is a notoriously insecure communications medium.  And much of the blame for that is due to the design flaws of the world's most popular Internet browser: Microsoft Internet Explorer (IE).

To its credit, Microsoft has in recent years sought to make its flagship browser more secure.  But the fact is, the bulk of malicious programs circulating on the Internet exist because of flaws in the security architecture of IE.  In many cases, simply viewing a "bugged" Web page is enough to compromise your PC.

Another serious problem is the in all versions of Windows, IE is literally part of the operating system.  Any changes you make to security settings in IE affect your entire PC.  And, if IE has a serious problem, reinstalling the program may not fix it.  You may need to reformat your entire PC's hard drive!

Now, hackers have discovered yet another serious flaw in IE—one that allows them to steal passwords you enter when you log into your online bank or securities accounts.  Microsoft admits it has not figured out a "patch" to solve the problem.  And hackers are moving quickly to exploit the flaw.  As many as 10,000 Web sites have already been compromised. 

Microsoft has come up with some complex "workarounds" to the problem.  You can read about them here. The best way to deal with the fundamental flaws in IE, however, is to ditch it for a more secure browser.  Unfortunately, you can't uninstall IE altogether, because it's part of all Windows operating systems.  But, you can use an alternative browser, such as Mozilla Firefox. 

Firefox and other non-Microsoft browsers aren't perfect.  They all have their own security vulnerabilities.  But because they are standalone programs, those vulnerabilities tend to be less serious.  Also, since these programs have a smaller installed base, hackers find them less attractive targets.

I've been using Firefox for more than two years.  Other than the fact it’s a huge memory hog, I love it.  A few applications designed specifically for IE that won't run on it, but as Firefox's popularity has increased, the number of incompatible applications has declined.

One thing's for sure.  Until Microsoft makes fundamental changes in the design and implementation of IE, hackers will continue to find and exploit security flaws in the program.  But since IE is by far the world's most popular browser, Microsoft has little incentive to do anything more than fix problems as they arise.

If you're concerned about Internet security, your only real alternative is to stop using IE.  And the sooner you do it, the better.

Copyright © 2008 by Mark Nestmann

(Microsoft has now issued an emergency patch for this vulnerability. To download it, go to http://www.microsoft.com/technet/security/bulletin/MS08-078.mspx.)

Being Anonymous Online is Now a Crime

In today's world of spyware, social networking services, and numerous other technological threats to privacy, it's hard not to leave tracks on the Internet.  But now, trying to use the Internet anonymously may be a crime.

Exhibit 1 is Lori Drew.  If you haven't heard of her, that's understandable.  But in the online world, Lori Drew is famous.

In 2006, Drew, assisted by at least one accomplice, created an account on the popular MySpace social networking Web site.  She created the account in the name of a 16-year-old boy, calling herself "Josh Evans."  "Josh" then initiated an online romance with 13-year-old Megan Meier.  However, Drew allegedly targeted Meier through her younger, male alter ego because the young woman had made unflattering statements about Drew's daughter Sarah.

For a few weeks, "Josh" and Megan exchanged increasingly affectionate messages.  But in October 2006, "Josh" sent Megan a message that read, "I don't want to be friends with you anymore because you're not nice to your friends."  Later, "Josh" wrote Megan, "The world would be a better place without you."

Those messages might seem innocuous enough.  Teenagers (and adults for that matter) are always insulting one another.  But members of social networking services may have a network of dozens, hundreds, or even thousands of online "friends."  These individuals can often read postings intended for other friends.  As a result, the messages led many of "Josh's" and even Megan's friends to unleash a torrent of insulting messages to Megan.  Allegedly, that's what Drew wanted.  But she surely didn't anticipate what happened next.

On Oct. 15, 2006, Megan hanged herself in her bedroom closet.  She was pronounced dead the next day. 

Megan's parents naturally blamed "Josh"—in reality, a 48-year-old woman—for the death of their daughter.  And, once prosecutors were able to track MySpace records to connect Josh to Lori Drew, they began building a case against her. 

The jury at Drew's trial in November 2008 convicted her of three misdemeanor counts of computer fraud.  The basis of the fraud?  Violating MySpace's terms of service, which require that users be "truthful and accurate" when registering.  Therefore, prosecutors could interpret the false profile as "Unauthorized Access."  This violated a 1986 computer fraud law. 

Drew is appealing the verdict.  But as the law now stands, if you violate a Web site's terms of service by registering under a fake name, you may be committing a crime.  And while Lori Drew should be held accountable for her actions, making Internet anonymity illegal surely qualifies as an unanticipated—and unjustified—result of her conviction.

Copyright © 2008 by Mark Nestmann