The Black Hat Technical Security Conference was this week and as you would expect, it was jam-packed with internet security geeks, researchers…and hackers alike.

Such is the case of Robert Hansen and Josh Sokol, two researchers who spoke to a large crowd during the conference about their attempt to hack into internet encryption technology (SSL) in order to find out what hackers can learn by putting together pieces of information left by a user’s internet browser during or after their internet session.

Without getting to geeky myself, Hansen and Sokol focused on SSL (Secure Socket Layer) because it is what internet browsers use to encrypt secure information travelling to and from website servers.

The idea behind their research was to find out how many bits and pieces they could first extract from an internet browser’s communication with website servers, then find out if they (or a hacker) could piece that information back together in order to get a better picture of what the secure information looked like. So they picked, poked, and prodded at SSL encryption not to hack it completely, but rather to find out how your average user’s internet browsing practices can leave hackers traces of information that they can build on.

It sounds as if their research provided results, due to the fact that during their presentation, Hansen and Sokol was able to outline several (and I’m talking more than three) weaknesses:

“The vulnerabilities arise out of the fact people can surf the Internet with multiple tabs open in their browsers at the same time, and that unsecured traffic in one tab can affect secure traffic in another tab…”

Don’t panic, the researchers admitted that it would be terribly hard for a hacker to use their method to actually turn internet security as we know it on its ear tomorrow. It just reinforces the fact that we need to be careful when we are browsing the web in order to make sure we are not making it easier (even if just a little) for hackers looking for ways to extract important information.

Another way we could be helping hackers listen into our conversations with the internet is via our home routers. Craig Heffner’s experiment consisted of using internet browsers via fake or malicious sites, to hack into home routers in order to launch attacks that could extract sensitive information, among other things. Heffner mentioned that it helps if the user hasn’t changed their default router username and password; but he says “Once you’re on the router, you’re invisible — you can do all kinds of things.”

That sounds as if the way we use internet tools when we visit sites where we have to enter secure information, could play a hand in the ability of a hacker to get hold of our information and do some serious damage. Just goes to show how vigilant we have to secure our own internet safety. “Nobody is gonna look out for you better than you” is what I always say.

via: Yahoo! News

The short answer is a resounding NO!

Social gaming is the new IT factor in Social Networking.  There are tons of Social Games that are accessible through iPhone apps, Facebook, and other Social Networks.  Even the mega traditional gaming companies, like EA Sports, are getting into Social/Online Gaming.

Social gaming is exciting and a way to socialize with a multitude of individuals from around the world.  However, when creating a user account to engage in social gaming networks, a user is essentially signing away a host of legal rights.  After reading several Terms of Service agreements of the most popular social gaming networks, I have concluded a player uses these services at their own risk.  Below are some clauses that I found particularly troublesome:

1.  Privacy.  Most social gaming privacy clauses will promise not to share or sell your personal information.  However, the clauses go on to state how the service provider collects your information and how and what will be shared.  For example, when using a social gaming service, the service will send Cookies to collect information about your Internet usage.  The cookies will also collect “certain technical information” about your computer and Internet Service Provider.  Third parties companies, who have a relationship with the social gaming service, can also send Cookies to your computer to collect Data.  In addition, those companies may have access to your personal information.  In most cases, players are automatically enrolled in third party programs and/or services and the social gaming service can not provide you with an option to opt out of these programs or services.

Privacy laws require Internet Service Providers to disclose how and what information is collected from users of their service.  Although, the data collection process may be questionable, if disclosed properly it is permitted.  However, users of Social Gaming sites may still want to think twice before engaging in such services.  Recently Storm 8, a provider of Social Games for iPhones, was sued for collecting phone numbers from iPhone users without disclosing this practice to users or with their consent.

3. Data Security.  Most Social Gaming Services protect user personal account information.  This information includes birth dates and billing information.  These sites state all account information is stored on secured severs behind firewalls.  Most services use SSL technology to encrypt the account information.  Usually only social security numbers, billing information, and dates of births are encrypted.  Generally encryption does not apply to email addresses, phone numbers, or any other identifying information.

3.  Defamation. All Social Gaming Networks prohibit any defaming, harassing, intimidating, or discriminatory behavior.  However, the Social Gaming site has the right to remove this information, but is not obligated to remove the offensive material.

4.  Intellectual Property.  Any copyrights or trademarks the User owns or creates on the Social Gaming site belongs to the copyright or trademark owner.  However, the user grants the site a royalty free license to use the copyright or trademark as they wish.  When dealing with copyrights, the social gaming site can sell the copyright, make a derivative work (ex. turn a short story into a movie) of the copyright, publish or broadcast the copyright without any compensation to the copyright owner.  Essentially, the Social Gaming site can use your copyright to make money while not paying you. Ouch.

5. Right to Use Your Likeness.  Users also give the Social Gaming site a right to use their persona, name, or likeness without any compensation to the the User.

6. All Users are prohibited from advertising or promoting themselves or any business or service.  However, the Social Gaming site can include the User in advertising or promotion campaigns without any compensation.

In conclusion, when a person signs up to use social gaming services, they should read the Terms of Service Agreements and be aware of their legal rights.  In my opinion, engaging in social gaming sites legally benefits the service provider and not the user.  However, the player is entertained and sometimes that is enough.  My advice: User Beware.

If you haven’t figured it out by now, Social Media is mainstream.  Because of Social Media’s popularity, employers and employees have to be careful when engaging in Social Media in and outside of the workplace.  Misuse of Social Media by employees can expose companies to liability, lost customers, and misappropriation of intellectual property.

EVERY company should have a Social Media policy outlining how employees should conduct themselves when using Social Media tools.  This conduct should be followed whether using Social Media in a work capacity or for personal use.  Remember, once something is posted on Social Media sites, it is forever out in cyberspace for the world to see.

When implementing a Social Media Policy, a company should ensure the policy contains the following provisions:

1. When employees are using social media tools for personal use, they should not use any company trademarks (identifying logos, names), or copyrights in any manner.

2.  Employees should never hold themselves out as a representative of the company, unless they have received express permission from legal and management to do so.

3. Employees should never disclose or discuss company confidential, trade secrets, or other propriety company information on Social Media platforms.

4. When using Social Media platforms, employees should never engage in false, inappropriate, threatening, harassing, or defaming conduct that would be harmful to the company, employees, or damage company relationships.

5. Employees should be aware that when using Social Media tools at work, the employer has a right to view and monitor Social Media use even if the employee is using their personal Social Media accounts.

When employers provide employees with Social Media guidelines, they should also offer Social Media training and give examples of inappropriate conduct.  Investing in Social Media guidelines and training now can save a company a huge headache later.

When Copying A Work If You Give Credit, Do You Still Need Permission to Copy?  Before you have to even consider playing your ‘Get out of Jail Free’ card the short answer is absolutely yes!

There is a huge misconception among Internet users and Bloggers that as long as credit is given to the Copyright owner, it is permissible to copy, reproduce, use snippets or paraphrase of the copyright protected work.  However, the Copyright Act clearly states: any person who exercises the exclusive rights of a copyright owner, without the copyright owner’s express permission, is an infringer of copyright.  17 USC sec. 501(a).

This means that anyone who wants to use the copyright of a copyright owner must directly contact the copyright owner and receive written (express) permission to copy or reproduce the work.  Simply giving credit will not do.

This law also pertains to photos.  When writing blog posts, most bloggers simply search the Internet for an image to complement their blog post.  This is a dangerous practice and can result in a Cease and Desist letter from the Copyright Owner or a Copyright Infringement action.  To avoid legal action, simply contact the owner and ask if it is permissible to use their image.  The majority of Copyright owners will agree as long as you give them credit.  A simple email will only take 5 minutes to write.  This is a small time investment to ensure you are not breaking the law.  If you can not locate the Copyright owner, use your own image and/or writing.  Copying without permission is simply not worth the legal headache.

However, there are certain instances where copying a work without the Copyright Owner’s permission is permissible.  A copyright owner can use a creative commons license to allow users to use their work without permission in certain circumstances.  Below is an example of a Creative Common License:

1.  You are free to copy the work as long as you attribute the work to the copyright owner.  However you can not use the work for commercial (monetary) purposes.

Lastly, a statement such as the one below, does not protect an individual from Copyright Infringement Actions:

If you hold the copyright(s) to any music or other content that can be found here and would like for it to be removed, please contact me and it will be removed immediately.

This clause is not a “safe haven” for Copyright Infringers.  I will say it again, you must get the Copyright Owner’s express permission to use the Copyright protected work.  The above clause will only expose an Infringer to liability.

As I previously discussed, some business structures are just bad choices.  Fortunately, there are several good business structures to choose from.  If you are considering incorporating your internet business, you have probably heard the terms C-Corporation, S-Corporation, or LLC.   Depending on your business unique circumstances, you and your attorney or CPA can determine which is best for you.

A C-Corporation or Inc. have the following characteristics:

• Personal liability protection. Business has its own identity and is separate from the owners or shareholders.  The assets of a shareholder or owner cannot be accessed by entities or persons the corporation may be liable.
• Free transferability of interests. Corporation can issue an unlimited amount of shares and shareholders can transfer their ownership
• Continuity of life. Corporation can exist for perpetuity.
• Can issue an unlimited amount and classes of stock.

HOWEVER, a C-Corp should only be considered if your company is financially able to maintain the corporation and your company has a Board of Directors and Investors. Why? C-Corps are:

• Expensive to maintain.  The corporation incurs annual fees to maintain the corporation status.  Administrative costs of accounting and tax preparation.  Federal income tax on corporation is high.  Also shareholders are taxed on their ownership. This is called Double
  Taxation.
• Administrative Burdens.  Must have annual shareholders meetings; issue stock; keep and maintain corporate minutes; have a board of directors and officers.

A  S-CORPORATIONS are a business structure that operate like a C-Corporation but S-Corporations do not incur Federal Corporate Tax.

The Characteristics of a S-Corporation are:

• Operate like C Corporations.  (See C-Corp above)
  • The difference between a C-Corporation and S-Corporation is the tax treatment.  C Corps have a high federal tax rate and S-Corps are taxed like partnerships, i.e., shareholders are only taxed on profits on their personal income tax return.

HOWEVER,

• A S-Corporation can only have 100 shareholders. 
• A S-Corporation can only issue one class of stock.

A Limited Liability Company is a hybrid structure that is a cross between a corporation and a partnership.

The characteristics of a Limited Liability Company are:

• Benefits of liability protection like a corporation
• It is Simple to set-up
• Taxed as a partnership. No corporate tax.
• Can elect to have a single-member LLC or Multi-member LLC.
• Free transferability of interests in LLC.
  • Continuity of Life of LLC (at least until the last member has been disassociated with the LLC)
  • Does not require yearly administrative costs and burdens as C Corporations and S Corporations

HOWEVER,

• LLC cannot issue an unlimited amount of shares.  It can only issue stock in limited circumstances.  Basically members who are owners are issued unit certificates that represents their ownership in the company.
• If you issue stock or securities similar to a C Corporation, the LLC will loose its status as a Limited Liability Company and will be considered a C-Corporation.

Remember to consult an attorney or CPA before choosing a business structure.

Previously I wrote a post on points of consideration when choosing a business structure to organize your internet business.  I mentioned several business structures that are adequate.  However, there are two business structures you should not consider.  They are Sole Proprietorships and Partnerships.

A Sole Proprietorship is a business structure that includes only one individual.  Characteristics of a Sole Proprietorship include:

• Low set-up cost.  There is no fee to pay and you may only need a fictitious name or business license;
• A social security number or an employment identification number may be used;
• All income derived from the business is personal income and is taxed at the owner’s personal income tax level.

But the not so good thing about Sole Proprietorships are:

• There is no protection from personal liability.  Essentially the Sole Proprietorship and owner are one and the same.  If the business is sued, the business owner can loose personal assets.
• No continuation of life for the business. So once the owner quits, the business is no more.
• There can only be one owner.
• Interest in the business can not be transferred.

The other type of business structure that is not a good choice is a Partnership.  A partnership is formed when a group of individuals go into business together.  Characteristics of a Partnership are:

• Partners can transfer interests in the business;
• Owners can determine how long a business will last and  under what circumstances it will end;
• No federal tax on the partnership, Taxation is passed through on each partner’s personal tax return.

However, Partnerships can become a liability because of the following characteristics:

• There is no personal liability protection.  Thus if the business is sued, the partners are personally liable with their own personal assets;
• All partners are jointly liable for any adverse actions committed by any partners.

If you are a sole owner or joint owner of an internet business and are in the beginning stages of establishing the business, operating as a sole proprietorship or a partnership may seem like the best option.  They are easy to set up and maintain and require very little up front costs.  However, as you begin to attract customers or audience, the potential for liability becomes greater.  For example, if you are selling a product and the product is defective, your company can become exposed to potential lawsuits.  Likewise if you are running an informational website and the site has technology that gathers users’ personal information and that information is collected without notifying the user, the company is exposed to Invasion of Privacy Claims.  Organizing your internet business in a structure that protects all owners form personal liability is the best solution in asset protection even if you think you don’t have any assets to protect.

If you are advised to enter into any of these business structures, get a second opinion.

Last week I wrote a post about Intellectual Property Clauses in Social Networking Sites’ Terms of Service Agreements.  As I stated in the article, the Intellectual Property Clause is very important when intellectual property (copyrights and trademarks) is shared on the internet.  However, there are other clauses or provisions in a Terms of Service Agreement that are equally as important and adequately protect the Internet Company against certain types of liability.   Before an internet start-ups gets on the net, the company should include these 5 provisions in its Terms of Service Agreement.

1. Description of Service. Include a very detailed description of the services provided by the website.  This provision is important because users can get an understanding of the services and how they work before signing up.

2. Rules of Conduct. This provision prohibits defamatory, abusive, harassing, threatening, or an invasion of a right of privacy conduct.  It also can prohibit illegal activity and solicitation.  In addition, the provision should include consequences if a user of the site engages in this type of conduct.  Consequences can include blocking the user from the site and deleting the user’s account.

3. Disclaimers. These disclaimers should include information regarding whether the site is collecting personal information of the users; what the site does with the information collected (does the site sell the personal information to third-party service providers) and what type of software is used to collect the information.

4. An Indemnification or Limitation of Liability Provision. This clause requires a user to release the Internet Service Provider from any claims, damages, or cause of action (liability) that arise out of the user’s interaction with other members of the site.

5.  Governing Law. The governing law provision dictates which state’s laws will govern if there is a dispute between the user and the internet company.  Usually the law governing state is where the internet company is located. It also addresses whether the user agrees to automatic arbitration or mediation should a dispute arise between the user and internet company.

There are tons of other forms of Terms of Service Agreements on the internet.  However, I highly recommend hiring a new media attorney to properly draft your company’s Terms of Service Agreement.  Form agreements NEVER address the unique and specific needs of each internet company’s business and model.

Every time we join a new social network, there is always a page or pop-up that requires us to read, acknowledge, and accept the network’s Terms of Service Agreement.  Unfortunately, most of us never take the time to read the Terms of Service Agreement.  As a result we agree to terms that we may not be comfortable with.

There are several key components of Terms of Service Agreements that all users of social networks should understand before joining a site.  They are:

1. An outline the services provided.
2. An explanation of what type of content the user can download and share on the site.
3. A statement regarding who owns content provided by the user on the site.
4. An outline of the required conduct of users of the site.
5. A requirement that users comply with applicable laws and regulations.

All of these terms are important.  However Number 3 definitely comes into play when users post original content they have created, i.e, intellectual property. As we know, intellectual property is owned by its creator. However, an owner of intellectual property can always license, sell, or transfer rights and ownership in the intellectual property.  Intellectual Property clauses in Terms of Service Agreements, usually grant the social network a royalty-free license to use the intellectual property as the site sees fit.  Social networking sites must obtain an intellectual property license from its user because if an entity uses user’s intellectual property without their permission, the user can assert a claim for infringement.

Considering the potential legal claims for infringement, all social networking sites have very extensive and iron-clad clauses regarding the sharing of intellectual property on the social network. Usually the clauses contain the following terms:

“You grant the ISP (social network) a perpetual, royalty-free (no payment) irrevocable, non-exclusive license to use, reproduce and distribute your Content within the service…….You authorize third parties to use and reproduce your content.” Second Life TOS.

In some cases the social network can use your content in any or all media for marketing and/or promotional purposes in connection with the Service. Furthermore, some Terms of Service Agreements state that any intellectual property you post on their site is 100% owned by the site! Ouch!

Usually if a user terminates the service with the social network, these clauses are no longer in effect.  But users of social networks must remember to read and understand Terms of Service Agreements before clicking your acceptance.  Crying foul after you have given up your control of your intellectual property, is not a good defense.