According to Federal Computer Week (FCW), "The virus is a variation of a three year old worm called SillyFDC which spreads by copying itself from one piece of removable media to another. When plugged into another computer the virus will automatically download code from another location."
   

The Associated Press and other news organizations reported that, "...Messages were sent to department employees informing them of new restrictions. As part of the ban, the Pentagon was collecting any of the small flash drives that were purchased or provided by the department workers...."

Fox News offered this video update, which described the serious nature of the attack.

This situation raises the wider questions regarding portable media. While these devices have long been barred from classified networks, some government organizations around the globe ban all USB use by staff. Examining the pros and cons associated with turning off USB drives can lead to an interesting dialogue. 

Basically, the decision comes down to ease of use and customer satisfaction versus the serious security threat posed by a loss of sensitive data. In addition, this DoD case raises the virus threat that can come up with portable media.

So what does your organization do? Are USB ports enabled on PCs and laptops?     

Some experts estimated that McColo hosted the machines responsible for 75% of the global junk email traffic sent. The relief is expected to be temporary for those trying to stop the unwanted email, since other servers will likely be found to send out the spam.

The story was covered by numerous sources including the Washington Post, who initially broke the story. Here's an excerpt:

"Also unclear is the extent to which McColo could be held legally responsible for the activities of the clients for whom it provides hosting services. There is no evidence that McColo has been charged with any crime, and these activities may not violate the law.

Mark Rasch, a former cyber crime prosecutor for the Justice Department and managing director of FTI Consulting in Washington, D.C.,. said Web hosting providers are generally not liable for illegal activity carried out on their networks, except in cases involving copyright violations and child pornography. "

Others who covered the story included BBC News and ComputerWorld.  

The BBC reported, "Anti-spam firm Ironport has seen junk mail levels drop by 70% since McColo was taken offline on 11 November.... A recent study by computer scientists from the University of California, Berkeley and UC, San Diego (UCSD) found that spammers manage to turn a profit despite only getting one response to every 12.5m emails they send."

It will be very interesting to see if the amount of spam sent return to previous levels - and how fast it happens. In Michigan, we have seen a steady increase in the amount of email we block over the past few years. We were blocking over 90% of incoming email due to spam or viruses, but I'll let you know if that number drops significantly in coming months.

What did you see happening last week? Did spam numbers drop in your enterprise?     

Arstechnica.com said it this way, "Liberal democracies aren't generally pleased with massive state-run mandatory Internet filtering schemes, but Australia's government is plowing ahead with just such a project...."

"Family First would consider a mandatory ISP-based filtering system that protects children by blocking illegal content like child pornography, but allows adults to opt out of filtering to access material classified R18+ or less," said the party.

While many groups have lined up against the program and call this censorship, the government argues that parental responsibility simply isn't workable and that children are finding damaging material online. 

A related article was published back in August 2007 by Arstechnica.com which announced the $189 million (Australian) anti-porn tech initiative. According to that article,

"Approximately $89 million will be used to establish Australia's National Filter Scheme, which will impose burdensome filtering requirements on ISPs and provide Australian citizens with free* access to PC-based Internet filtering software. The filtering systems will leverage the Australian Communications and Media Authority's official Blacklist, which is based on the country's National Classification Scheme. According to a statement issued on Friday by communications minister Helen Coonan, the Australian Communications and Media Authority is also evaluating plans to extend the Blacklist to include 'terrorism and cyber-crime sites upon prescription by the Attorney-General.'"  

Arguments against the program are made on the basis of degradation of Internet performance and limiting the free speech of adults. And yet, it is hard to argue with the Australian government's assertion that this "illegal content" problem is now out of control in cyberspace. The challenge becomes defining what content is illegal with current technology and not blocking content which is legal for adults.

ABC News in Australia offered commentary by Michael Meloni on the high price of internet filtering and the need to focus on children. Here's a quote:

"To provide a safer environment for children online we need to focus on areas posing a real threat to young Australians like cyber-bullying, identity theft and online predators. Filtering does nothing to reduce these risks. Just like we educate children about staying safe outside, we need to educate them about staying safe online. Walk them through it just like we'd walk them to the park. If that means educating parents unfamiliar with the Internet as well, then let's do it." 

While it would be inappropriate for me to take sides on this effort as CISO in Michigan, I understand the sense of urgency. No doubt, the free speech advocates have great points against limiting the freedoms of adults in society, but it is also government's responsibility to protect it's citizens against crime. The challenge becomes how far can and should governments go to restrict adults, fight predators or help children.

 There are entire books on the history of this topic in America, including the Children's Online Protection Act of 1998 (which includes action required by the states), the Children's Internet Protection Act (CIPA) of 2000, and related actions taken by the courts.   

 So why do I put this information about Australia in an American magazine? These same issues are still very real in the USA. New questions come up every day about our government role at a federal or state level. I expect this topic to get much more attention here in 2009 and beyond than it did in 2008. The debate here has been somewhat delayed, due to the election campaign and the economy.

What are your thoughts?    

The Microsoft website offered details of how to get the updates.

Computerworld offered two stories related to the critical new vulnerability. The first story described attack code for critical Microsoft bug, and another article released on Saturday described how the Gimmiv worm feeds on latest Microsoft bug.

Microsoft released the patch two weeks prior to the normal schedule, since they were seeing active attacks on the Internet. According to Computerworld:

"Both Symantec and McAfee Inc. said today that they had seen only a very small number of attacks based on this exploit, but Symantec says that, starting yesterday evening, it found a 25% jump in network scans looking for potentially vulnerable machines. That could be a sign that more attacks are coming.

That scenario becomes more likely, too, as more tools that exploit the flaw are released to the public. Sample exploit code was posted to the Milw0rm.com hacker site today, and over the next few days hackers are expected to move that code into attack tools that are easy to use."

Some experts were predicting that the attack code will soon be used to build botnets with infected computers. What is clear is that all governments need to respond immediately and apply the patch, if they haven't already done so last week.

Has anyone seen this attack on their networks? 

"You know you shouldn't do it, but that liquid courage convinces you otherwise and, soon enough, you've fired off a hasty e-mail to an ex, a co-worker or, worst of all, a boss.

Many a relationship has been prolonged -- and perhaps many a career has been cut short -- by the dreaded drunken e-mail."

At first, I thought this was a bad joke. Was Google trying to add some comic relief to our lives? Could this be an attempt to change the subject away from our 401Ks and our current Wall Street banking woes?

But I kept running into this story all week. Some on mainstreet are honestly thinking that this is some type of breakthrough. Even morning talk shows are offering demos on how hard the Google math is.  The Internet has plenty of video interviews on this topic. One video from NBC San Diego can be seen here.

Personally, I find this topic to be beyond humorous. Is this really such a big problem? Will people really use this new feature? Perhaps I'm living on a different planet or not consuming enough alcohol, but are millions of cyber surfers really drunk? 

OK, I'll try and offer some serious commentary on this new development.

The Problem: Sure, people send emails and instant messages in poor judgment. They hit the return button millions of times each day - only to regret the message later. We all need to stop and think before we click. Sometimes these messages are accidental and other times they are intentional but naive or unwise. 

Most people occasionally use the Internet when they should go offline and talk in person. I've intervened in many email wars at work over the past decade between professionals sitting in back to back cubes. This happens even when people are sober.  

The Good: People are finally confronting the fact that there are real-world consequences to their virtual actions. As I've said in several blogs, our virtual worlds and real world events are merging at home and work.

The Trend: Get ready for more technology tools and techniques to build trust online. We have a long way to go in this area. How can we connect our offlines values with our online world? How about a virtual conscience based on your professed values? More accountability must come with more social networking opportunites at work.

The Solution: What we need is cyber ethics for grown-ups. This involves people, processes and technology. Although technology can help (and more tools are coming), no Google or Microsoft tool will do this for you. We're talking about character and integrity in a cyberspace that resembles the Wild Wild West.  I describe this trend and personal solutions in detail in my soon to be released book, Virtual Integrity.

One final thought, Google is very good at marketing and offering what customers want. Obviously, they did some market research before rolling this out. It clearly passed the "cool" or "daily buzz" litmus test. So how can we offer similar security tools that help overcome risk and also meet customer needs at work? There is a lesson in this (somewhere) for IT professionals.

Any ideas on how to make it cool to change your password? Now that would be a breakthrough.       

- Our English friends provide a different voice and perspective on world events and on happenings in the USA.

- They are often a few days or weeks (sometimes even months) ahead of us in their discussion of various topics, including technology trends.

- They don't have to be as politically correct - they can call an election or economic event as they see it.   

- Personal preference. I lived in the UK (in North Yorkshire) for almost seven years - I just like the way they think and write across the big pond.

So what have they been talking about lately? Besides detailed analysis on the upcoming US elections, the $700 billion economic bailout and Europe's own banking crisis, one hot topic in their technology section is "The Grid."

Never heard of it? Check out this 4+ minute YouTube video on The Grid.

Europeans think this is a big deal. How do I know? Check out these recent headlines from our scientific colleagues, keeping in mind that these writers are known to play down just about everything: The Grid powers up to save lives and seek the God particle  or Grid of 100,000 computers heralds new internet dawn.  

Here's an excerpt from the first article:

"Scientists believe that the Grid, described as a "worldwide revolution," also has the capacity to find a cure for cancer and save lives following a natural disaster.

Excited researchers, from Vancouver to Beijing and Oxford to Melbourne, watched yesterday's launch at CERN, the European Organisation for Nuclear Research, near Geneva, through a live video link up.

It has been vaunted as the next evolution of the internet and may even allow researchers and pharmaceutical companies to find a cure for cancer faster than previously thought possible. This is because the Grid is able to crunch massive amounts of data very quickly by, in essence, turning a desktop PC into a supercomputer."

There is no doubt that these are exciting times, but many will see these events as somewhat scary or as another step towards "Big Brother." Indeed, other headlines on Sunday, October 5, such as Government will spy on every call and e-mail, highlighted British Government plans to expand monitoring to capture terrorists.

Regardless of our personal opinions, "The Grid" is coming. While Americans spend the next few months focused on important political and economic matters, technology keeps moving. I suspect we will spend quite a bit of time in 2009 and beyond discussing the good and bad impacts to society that the "The Grid" will bring upon us. If, as Microsoft says, we are trying to build "end to end trust" online, there is no doubt that hundreds, perhaps thousands, of articles will be written on this topic over the next decade.  

Some may even say, I heard about this way back in the Spring. True, Fox News ran an article in April 2008 entitled: The Grid could soon make the Internet obsolete. It's a very good article.

But funny thing, it originally came from The London Times.