The Wayback Machine - https://web.archive.org/web/20111229051752/http://redtape.msnbc.msn.com:80/
  • Huge Eurobank, rated 'Britain's worst,' now accused of gouging US consumers

    The accusations are as outrageous as they are plentiful:  Hundreds of “robocalls” --  in one case, 800 to a single person -- to collect auto loan debts;  illegal repossession of cars from active duty military deployed overseas;  late fees assessed three years after the fact and then compounded into $2,000 or $3,000 bills; harassing calls to friends, neighbors, co-workers -- even children -- on cell phones. And now, a flurry of lawsuits filed around the country, and lawyers fighting over potential clients.

    The defendant in the lawsuits is Europe’s largest bank, Banco Santander S.A., which is preparing to make a big push into U.S. retail banking. But many Americans already have been introduced to the Spanish financial powerhouse, a first encounter that many liken to a nightmare.

    Santander’s most visible presence in the U.S. market is the result of a buying spree begun in 2009, when the bank began purchasing billions of dollars in auto loans -- many of them subprime loans for used cars -- from Citibank, HSBC and a host of other banks. 

    But if the cascade of complaints and lawsuits are accurate, Santander Consumer USA has tried to immediately turn those receivables into lucrative assets by assessing massive penalty fees and repossessing cars under dubious circumstances.

    "They have a good business model if you are a crook," said lawyer Johnny Norris, who filed one of the first class-action cases against Santander Consumer USA, the Spanish bank's U.S. arm.  "It's a very lucrative but unlawful business plan. ... It's really terrible and we're trying to put a stop to it."

    Laurie W. Kight, vice president of communications for Santander Consumer USA, said the company would not consent to an interview for this story.

    "(Santander) declines to comment at this time," she said in an email.

    While the Internet has been awash in complaints about Santander’s debt-collection practices for months, legal proceedings are just now reaching a fever pitch.  Norris said he's filed more than 100 individual cases against Santander and he's considering hundreds more.  One of his clients was called more than 800 times by an automatic dialer, he said, alleging that the calls represent a violation of the Telephone Consumer Protection Act. If so, each call could net a penalty of $1,500 for plaintiffs.

    "Our cutoff is 100 calls" when the firm screens potential new clients for Santander lawsuits, he said.

    The class-action case, with seven lead plaintiffs, was filed in federal court in Alabama.

    One plaintiff, Leslie Haynes, purchased a used BWM in 2007 from a dealer in Birmingham, Ala., according to court documents. A year later, Santander collectors began peppering her with demanding calls. The lawsuit claims agents misled her about the balance of her loan, tried to trick her into making additional payments, then refused to stop calling her at work. Agents also repeatedly frequently called relatives, even harassing her sick stepfather and his live-caregiver in the months before he died, it alleges.  The court filing does not indicate whether Haynes had made all payments on time.

    Another plaintiff in that case, Victor Shortt, alleged that Santander agents repeatedly called his minor daughter's cell phone, ignoring pleas to stop. A third, Jacob Glassmoyer, said Santander officials called his parents' cell phones repeatedly, at a time when one of them was undergoing chemotherapy, according to the lawsuit.

    Norris said Santander routinely uses another tactic after acquiring a loan from another lender: It searches records for past slip-ups -- such as a payment that was late by a few days -- then assesses fees retroactively, sometimes years after the fact. By calculating the loan forward from that point, and "cascading" the fees, the firm sometimes claims clients owe thousands of dollars in late fees, and demands immediate payment or threatens repossession.

    Another class-action case, filed in a federal court in California, accuses Santander of ignoring the Servicemembers Civil Relief Act, claiming the firm repossesses cars while active duty military are deployed overseas and refuses to lower interest rates to 6 percent, as required by law. The plaintiff in that case, Sgt. Charles Beard of Lemoore, Calif., serves in the U.S. Army National Guard, and was deployed abroad on Aug. 16, 2008. On Feb. 3, 2009, Santander repossessed his Kia Sportage, even after the bank was informed that a court order is necessary to repossess a deployed soldier’s car. 

    "One of defendants’ representatives told Mrs. Beard that she would go to jail for a stolen car if she did not turn in the vehicle," the lawsuit alleges. Santander also ignored complaints from Army legal assistance, and sold the repossessed auto at auction in March of that year, according to the lawsuit.

    The lawsuit claims such violations by Satandar of the Servicemembers Civil Relief Act are routine.

    "Defendants have a policy of failing to verify, prior to undertaking voluntary repossession, whether the person whose vehicle is subject to repossession is serving on active duty," it claims. "Defendants routinely ignore service members’ rights under the SCRA and wrongfully repossess their cars without obtaining the requisite court orders."

    Used car loans might seem like a hard way for an international bank to make money, but they've actually proven to be more resilient and recession proof that other forms of lending -- particularly mortgage lending. Cars, at the moment, appear to be better collateral than homes and are much easier to turn into cash after a borrower defaults. That's part of the reason that Santander was the most profitable bank in the world outside of China last year, and has been on the acquisition trail since the financial meltdown.

    The Spanish bank is Germany's largest auto lender, and has enormous auto loan portfolios across Central and Eastern Europe, said Mauro Guillen, a Wharton Business School professor who wrote a book about Santander called "Building a Global Bank."

    "Auto loans are low margin, but high volume gives you a good return," he said. "It's a typical way for Santander to enter a market."

    It's also lucrative. Santander Consumer USA earned a tidy $455 million in 2010.

    "It's a cash cow for them," Guillen said. 

    Santander has big designs for U.S. retail banking. It completed the acquisition of Sovereign Bank, largely a regional lender based in the Northeast, in 2009.  It recently received approval to convert from a savings bank to a national bank, and plans to begin rebranding 747 Sovereign branches as Santander early next year.

    But as the bank brings its impressive balance sheet to the wider U.S. market, it apparently has also exported its reputation for mistreating consumers.  Last year, a flurry of news stories in the British press labeled Santander "Britain's worst bank,” after it registered more than 160,000 complaints from account holders in a recent 6-month period, by far the most of any bank. The complaints typically involved frustrations with fees and customer service.

    Santander usually receives the most consumer complaints in Spain, too, Guillen said.

    Santander's move into U.S. auto loans has been aggressive.  In November 2009, it acquired $1 billion in loan receivables from HSBC for $900 million. It raised the stakes much higher in June 2010, when it announced it purchased $3.2 billion in loans from CitiFinancial, and also agreed to service another $7.2 billion in auto loans still held by CitiFinancial.

    Combined with a series of acquisitions from smaller lenders, and the loans it inherited from Sovereign, and analysts estimate Santander's U.S. auto loan holdings at $17 billion.  

    The banks' preference is for high-interest, subprime auto loans, which were reliably lucrative before the financial collapse, Guillen said. 

    They still are, argued lawyer Norris, because of what he says are the bank’s illegal practices.

    "They are taking these subprime loans while the loan is still active.  They are piling that loan as high as they can with fees, making as much money from the borrower as they can," he said. "Then they repossess the car, and sell the car.  Maybe there's a difference between the outstanding loan amount and the price they get at auction, but guess what:  Santander didn't pay 100 cents on dollar for the loan. They bought the car at a discount to start with."

    The Internet is awash with complaints of unfairly repossessed cars and sudden demands for lump payments by Santander. Many focus on confusion around the transfer of the loan to the Spanish bank from the original lender.  Thomas Tupper of Irvine, Calif., purchased his car through Citibank, but when the loan was transferred to Santander in September 2010, he says he ended up with nothing but trouble. Automated direct payments were received by Santander, and credited to his account, but he was still reported late to the nation's credit bureaus and assessed late fees by the bank.  Then, when he sold his car, Santander cashed the payoff check but still reported him as late. That forced him to make extra payments on the loan, even after the loan was paid off. He's only received partial refunds of the overpayments. (For more on his trouble, click here)

    Donovan Rogers, 34, of Abeline, Kansas, said Santander repossessed his 2005 Dodge Durango this year after purchasing his loan from the original lender. Rogers said he wasn’t alerted to the bank change. He claims he continued to send payments on time via money order to his initial lender, but Santander would later tell him it never received the payments. He says was unaware of the problem until weeks before the car was repossessed in May. He says he received nearly 500 phone calls from the firm during that time, and was threatened with criminal charges. Even though the pickup was sold at auction in June, he said he still receives calls from Santander demanding payment.

    “They've made my life a mess.  When I tell people my story, they are in awe,” Rogers said. “I thought I was alone until I found all these other stories online. I’m living a nightmare, but now I’ve seen stories of people with much worst nightmares than mine.”

    Accusations of unfair fees and repossessions don't figure into the lawsuits Santander is facing, however.  Lawyers are flocking to the cases because of potentially lucrative violations of the Telephone Consumer Protection Act and the Fair Debt Collection Practices Act. Santander agents routinely fail to identify themselves, use obscenities, call people other than the actual debt holder and reveal to those people details about the debt, the lawsuits allege -- all direct violations of the latter law. The bank has also used automated dialing systems and prerecorded messages directed to cell phones without permission, the lawsuits allege, a violation of the Telephone Consumer Protection Act. Willful violations of that law offer a $1,500-per-phone-call bounty to the plaintiff.

    Missouri lawyer Gary Green, who is also readying a series of lawsuits against Santander, thinks that the bank many have just overlooked consumer law when it raced to expand its U.S. presence.

    "I think that they've stumbled in without doing research," he said. "And they figured the claimants would act like most claimants and not realize they had any rights.  They figured they could take advantage of these people thinking individually they would have no voice. And maybe they just didn't read the federal law."

    Even outside of consumer issues, Santander's reputation is not pristine. Alfredo Saenz, the bank's No. 2 executive, received a pardon last month from lame duck Socialist Party officials in Spain, sparing him from a previously imposed lifetime ban from working in banking. In 2009, he was convicted of making false criminal accusations in an attempt to recover a $5 million loan dating back to 1994. 

    The bank's CEO, Emilio Botin, and other relatives are the focus of a tax evasion inquiry by the Spanish government involving a secret Swiss bank account that dates to the days of the Spanish Civil War in the 1930s.

    Santander also operated a so-called "feeder" fund that essentially acted as a front to entice investors for disgraced Ponzi scheme operator Bernie Madoff; clients lost a staggering $3 billion.  The bank says it, too, was duped by Madoff, and has already paid $235 million to the fund set up by Madoff trustee Irving Picard. It has also offered nearly $2 billion worth of stock to victims to settle pending lawsuits.

    But Guillen, who wrote the book on Santander, thinks it might be unfair to single out Santander for alleged aggressive debt collection tactics.

    "What bank doesn't have a lot of complaints right now? I can't imagine (alleged illegal tactics) are a part of an explicit business plan," he said. "Are they doing this more than other banks? Banks are desperate for cash right now. I don't know if Santander stands out as being more aggressive than other banks."

    And despite the complaints and lawsuits, he predicted the bank will successfully expand into U.S. retail markets.

    "And I would predict other acquisitions for them," he said.

     

     Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).
     

  • Senate GOP blocks consumer agency nominee Cordray, but who's to blame?

    Jacquelyn Martin / AP file

    Richard Cordray.

    Will Americans believe President Barack Obama was fighting for their consumer rights by trying to force a vote on Consumer Financial Protection Bureau nominee Richard Cordray, or will they believe Senate Republicans were fighting to prevent creation of an unwieldy new government agency with unchecked powers?

    We're about to find out.

    Thursday morning brought congressional theatre that ended with the Senate effectively rejecting Obama's nominee to head the newly formed Consumer Financial Protection Bureau.  There was little mystery to the vote --  44 Republicans pledged in May to block his nomination, and only 41 were needed to spike it. The final tally was 53-45, with Republican Olympia Snowe  of Maine voting "present." Sen. Scott Brown of Massachusetts, facing the bureau's inventor Elizabeth Warren, was the lone dissenting GOP vote.

    The only mystery is, who will Americans blame now?


    Obama and Democrats spent the week campaigning for Cordray in several states where Republican Senators face re-election campaigns, including Maine and Nevada.  Senate Republican minority leader Mitch McConnell of Kentucky responded by accusing Obama of playing politics.

    RELATED: Details of the vote from NBC's First Read

    “Now he’s suddenly making a push to confirm his nominee — because it fits into some picture he wants to paint about who the good guys and the bad guys are in Washington,” McConnell said on the Senate floor Tuesday. “... So once again he's going to use the Senate floor this week to stage a little political theater. He’s setting up a vote he knows will fail so he can show up afterward and say he’s shocked.”

    Speaking in Kansas on Tuesday, Obama argued that Republicans are simply being obstinate. 

    "Nobody claims (Cordray's) not qualified,” he said in a speech about the economy. “But the Republicans in the Senate refuse to confirm him for the job; they refuse to let him do his job. Why? Does anybody here think that the problem that led to our financial crisis was too much oversight of mortgage lenders or debt collectors?”  

    Political considerations aren't far behind, however, as White House Press Secretary Jay Carney said Republicans who vote against Cordray will have to "to explain to their constituents why they did not support common sense reforms," according to the Wall Street Journal.

    As a practical matter, Thursday's cloture vote prevented Democrats from ending debate on the Cordray nomination, thus preventing an actual vote on his nomination.  It doesn't mean Cordray has no shot to run the agency, however.  The administration could still attempt a recess appointment, and some observers speculate that the Senate vote is merely a step along that path.

    Such a move could threaten the legitimacy of the entire agency, however, and would undoubtedly lead to accusations foul play from Republicans, and perhaps trigger litigation from banks the agency would try to regulate. 

    But without a director, the bureau is already hamstrung on a number of fronts. Many of the bureau's regulatory powers don't kick in until a director is named.  It can't supervise so-called non-bank banks, like payday lenders, for example.

    “The list of financial tricks and traps that consumers are forced to deal with keeps growing,” said Travis Plunkett, legislative director of the Consumer Federation of America, an advocacy group. “Fourteen months after Congress created the CFPB, the agency needs a permanent leader so it is not fighting financial abuses with one arm tied behind its back.”

    The nascent bureau has begun to take on some less controversial tasks during this start-up phase. Last week it announced results of a story of credit card complaints; this week it released a new, simplified model credit card agreement that cuts down verbiage from 5,000 to 1,100 words.

    Still, Republicans held firm, because they say the new consumer bureau would have too much power as currently constructed.  Sen. Richard Shelby, R-Ala., the ranking Republican on the Senate Banking committee, went so far as to call it "a monster, as far as future regulation."

    Five Republican Senators, including moderate Susan Collins of Maine, attended a public event on Tuesday to reiterate their view that the bureau shouldn't fully open for business unless dramatic changes are made.

    “It is inconceivable that in this time of tight budgets that we would create a new agency that is completely unaccountable in terms of its budget,” Collins said.

     Among their demands: the bureau should be led by a commission, not an individual; it should be not have its own source of funding from the Federal Reserve; and it should be subject to Senate committee oversight.

    So far, Democrats haven't budged on any of those demands -- setting up a fight over public opinion that Obama didn't shy away from at his speech in Kansas,

    "Every day we go without a consumer watchdog is another day when a student, or a senior citizen, or a member of our armed forces … could be tricked into a loan that they can't afford -- something that happens all the time," he said. "And the fact is that financial institutions have plenty of lobbyists looking out for their interests. Consumers deserve to have someone whose job it is to look out for them. And I intend to make sure they do. And I want you to hear me, Kansas: I will veto any effort to delay or defund or dismantle the new rules that we put in place."

     Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).
     

  • Consumer: Trove of evidence didn't persuade credit bureau to fix error

    Thomas Tupper

    Tom Tupper and his young son, Josiah. Tupper says a mistake on his credit report cost him 48 points on his credit score and that credit bureau TransUnion ignored all the evidence he produced.

    A single error on your credit report can really hurt. It might drop your credit score 50 points, costing you an auto loan or pushing you into subprime mortgage status. It could cost a job if you're in the process of applying.  It could raise your auto insurance rates.  And, says consumer Tom Tupper, it's a direct insult to your integrity as a person.

    But worst of all: Sometimes it seems that no amount of hard evidence can persuade a credit bureau to fix such a costly mistake. At least, that's the story Tupper is telling. And he has plenty of evidence to back it up.

    Tupper's travails through credit bureau TransUnion's dispute resolution process sound like they sprang from a Joseph Heller novel; and the “Catch-22” he describes offers a glimpse at how bureaus apply justice the 20,000 times per day that consumers plead for help with a mistake on their credit report.

    "It is an insult to report something about me inaccurately. It’s not acceptable. … It’s a reflection of my integrity as a person,” Tupper said. ”I do take it personally.”


     TransUnion refused to answer questions about Tupper’s situation for this story.

    “To protect the privacy of consumers, TransUnion does not comment on individual cases,” said company spokesman Clifton O’Neal.

     But Tupper is eager to share his version of events.

    Tupper, an avid credit monitoring user, says he spotted an error in his TransUnion report in October indicating that he was 30 days late on a car loan payment in September 2010. He looked up his TransUnion credit score, and found it had plummeted by 48 points. Days later, when the mistake spread to Equifax and Experian, his scores from those firms fell too, but not as sharply.

     The 43-year-old Irvine, Calif. software engineer keeps copious records -- he has copies of every monthly statement from his car loan -- and he was sure he'd never been late. But the September 2010 blemish was even more curious because he was being reported late by Santander Consumer USA, a loan-servicing company that had taken over the loan from Citibank that month. He also sold the car a soon after, and had copies of the payoff check from the dealership that was deposited to pay off the loan. Finally, he even made an extra payment to Santander after he traded in the car, just to make sure there was no late payment.

    Fast-forward to October of this year, when Tupper looked at his credit report and discovered that Santander was reporting him as a deadbeat. His blood boiled.

    He immediately went online and filled out the TransUnion dispute form. He heard back four days later, when his request for a correction was denied and TransUnion affirmed the late payment.  Furious, he sent a second dispute form to TransUnion, this time in snail mail, along with a folder piled high with documentation.  Tupper shared the file with msnbc.com. Here's a sample of what he included:

    *A letter from Citi Financial and Santander making it clear that Santander USA only began servicing the account as of 9/6/2010. That meant Santander couldn't report him as 30 days late in September 2010.

    *Santander's first monthly account statement to him, showing his payment was received and credited on Sept. 17, 2010, and that his account was up to date.

    *A copy of the loan payoff check, including routing and transit numbers indicating it was cashed.

    *Loan payoff notes from both Citibank and Santander.

    Tupper heard nothing for weeks, so he called TransUnion on Nov. 15.  The response he received was straightforward:

    "They said, 'Here's the deal. We've just completed our investigation, and we're not going to change it.'" Tupper said.  "And the operator said that since I'd disputed it twice, any other dispute I tried would be seen as frivolous and would be ignored."

    When Tupper pressed for a reason, he said the operator was rude, but eventually told him that there was no way for TransUnion agents to verify his documents as authentic. She didn't offer him any way to make the documents believable to the firm

    "I kind of went ballistic," he said.  "I said, 'If you think about that, how can anyone prove anything to you?' "

    Similar complaints have dogged the credit reporting agencies and their dispute process for at least a decade. By law, the agencies are supposed to give consumers a chance to make their case when lenders place blemishes on their credit reports. But in practice, consumer lawyers argue, credit reporting agencies often ignore evidence supplied by consumers and simply ask lenders -- called furnishers, in credit bureau language -- to "verify" the debt. It's the equivalent of asking, "Did you say this?" When furnishers confirm they did, that's often the end of the case.

    Depositions taken from former employees in cases filed against the credit bureaus paint a frantic picture of dispute resolution, which often occurs in off-shore call centers. According to SmartMoney magazine, one TransUnion official said that workers were expected to complete up to 22 cases an hour. An Equifax worker estimated she was allotted four minutes per dispute.  There isn’t time for much more than a simple yes or no question to the lender.

    "It is really quite appalling when you really think about it," Tupper said. “When I gave that proof to TU and demanded they remove the incorrect entry, they basically ignored me and sided with the data furnisher... So here is the rub: What's to stop anyone from reporting anything derogatory about you to a (credit bureau)?"

    The credit bureaus, as a group, often argue that their system is overwhelmed with fraudulent disputes by shady credit repair agencies and consumers trying to game the system.  And they argue that many errors are corrected.  A 2005 report by Congress' General Accountability Office found that 69 percent of surveyed consumers who had disputed items on their credit report said they'd been removed.  That report also cited testimony from the Consumer Data Industry Association indicating these results for consumer disputes: data had been deleted in 27 percent of the disputed cases, but verified and left on the person’s report in 46 percent of the cases.

    Mountains of consumer complaints found online suggest Tupper's case is not unusual, however.

    "If I come at you with evidence, it seems to me that as an organization you ought to err on the side of caution, rather than side with the lender,” Tupper said. “... In simple terms, TransUnion has effectively taken the stance that there is no level of documentation that a consumer can maintain which they will accept as legitimate proof that they have wronged the consumer. If a consumer's banking records, along with the very account statements provided to the consumer by a lender, other banking transit documents, and payoff documents are not considered as adequately evidentiary by TransUnion in an accuracy dispute, then what hope does any consumer have of ever protecting themselves from victimization?"

    Tupper's story, however, has a happy ending.  He exercised a relatively new consumer right granted by Congress in 2005, but not implemented until last year that lets consumers dispute credit report blemishes directly with the furnisher after a failed dispute with a credit bureau.  Tupper sent his powerful packet of evidence to Santander via e-mail in late November, and followed up with a flurry of phone calls.  Santander quickly changed the way it was reporting Tupper's account to "paid as agreed," and within 48 hours, his credit report was clean again. His credit score returned to normal soon after.

    "For me, it was more infuriating than anything else because it was so wrong," Tupper said. "I wonder how many consumers in my position simply give up, and live with seven years of inaccurate credit scoring because they simply haven't got the means to fight back....  These agencies wield tremendous power in the lives of consumers, and unfortunately they are frequently difficult to hold accountable for wronging consumers.”

    RED TAPE WRESTLING TIPS

    If you feel you have an error on your credit report, it's important to file a dispute right away. There are  plenty of guides for doing so online; start with the Federal Trade Commission's instructions.

    The ability to dispute a report directly with a furnisher is an important new right for consumers. Here are tips on how to begin that process.

    And if all else fails, look for a consumer attorney with experience fighting Fair Credit Reporting Act cases at the National Association of Consumer Advocates website.

     Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).
     

  • Consumer agency shares top beefs against credit card issuers

    Top 10 credit card complaints
    Here's what consumers groused about in complaints filed with the new Consumer Financial Protection Bureau:
    Rank
    Issue
    Complaints
    % of total
    1. Billing disputes
    681
    13.4%
    2. APR or interest rate
    556
    11.0%
    3. Identity Theft / Fraud / Embezzlement
    546
    10.8%
    4. Other 454 8.9%
    454
    8.9%
    5. Closing / Cancelling account
    242
    4.8%
    6. Credit card payment / Debt protection
    224
    4.4%
    7. Other Fee
    224
    4.4%
    8. Billing statement
    209
    4.1%
    9. Collection practices
    201
    4.0%
    10. Credit reporting
    197
    3.9%
    SOURCE: Consumer Financial Protection Bureau
    msnbc.com

    Given a chance to complain, credit card consumers jumped at the opportunity. 

    The Consumer Financial Protection Bureau opened for business earlier this year, and its first actions were to solicit consumer complaints about credit cards and set up a system for resolving disputes.  In three months ending Oct. 21, cardholders filed more than 5,000 complaints and requests for help.

    An interim report issued this week offers insight into the bank practices that most bug consumers:  Billing disputes, collection practices, and debt protection sales pitches. Surprisingly, late fees did not crack the top 10.  

    Mysterious fine print is a common thread through many of the complaints.

    "The biggest thing we see is consumer confusion," said bureau spokeswoman Jennifer Howard.  "Customers and credit card issuers aren't always on same page when it comes to understanding the terms of the deal."


    According to the report, account holders struggle to understand both terms of their contracts and details of additional offers like debt protection.  There's a "mismatch between consumer expectations and the way the product functions," the report says.

    A big part of the bureau's mandate is to act as an express route for resolution of consumer issues. Of the 5,000-odd complaints submitted, 4,254 were forwarded to the bank involved; banks said they'd resolved 3,151 of those. Consumers disagreed about that satisfaction rate, with only 2,238 agreeing that their dispute had been solved. Another 500 said their complaints were pending.

    The text of the complaints is not public, but the bureau is working on a method for providing "public reports" that will include "certain aspects of credit card complaint data."

    Meanwhile, the bureau will soon begin accepting complaints about other financial products, such as mortgages and home equity loans.

    “When consumers contact us, we get a snapshot of how the consumer finance markets are working,” said Raj Date, a special adviser to the secretary of the Treasury for the Consumer Financial Protection Bureau. "We will continue to work with consumers, credit card companies, government agencies, and others to improve consumer education and ensure CFPB’s regulation, supervision, and enforcement efforts are effective.”

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Exclusive: Millions of printers open to devastating hack attack, researchers say

    Columbia University

    This time-lapsed image of a screen on an HP LaserJet shows the impact of a rogue print job used to reprogram the device.

    Could a hacker from half-way around the planet control your printer and give it instructions so frantic that it could eventually catch fire? Or use a hijacked printer as a copy machine for criminals, making it easy to commit identity theft or even take control of entire networks that would otherwise be secure?

    It’s not only possible, but likely, say researchers at Columbia University, who claim they've discovered a new class of computer security flaws that could impact millions of businesses, consumers, and even government agencies.

    Printers can be remotely controlled by computer criminals over the Internet, with the potential to steal personal information, attack otherwise secure networks and even cause physical damage, the researchers argue in a vulnerability warning first reported by msnbc.com.  They say there's no easy fix for the flaw they’ve identified in some Hewlett-Packard LaserJet printer lines – and perhaps on other firms’ printers, too – and there's no way to tell if hackers have already exploited it.


    The researchers, who have working quietly for months in an electronics lab under a series of government and industry grants, described the flaw in a private briefing for federal agencies two weeks ago. They told Hewlett-Packard about it last week.

    HP said Monday that it is still reviewing details of the vulnerability, and is unable to confirm or deny many of the researchers’ claims, but generally disputes the researchers’ characterization of the flaw as widespread.  Keith Moore, chief technologist for HP's printer division, said the firm "takes this very seriously,” but his initial research suggests the likelihood that the vulnerability can be exploited in the real world is low in most cases.      

    “Until we verify the security issue, it is difficult to comment,” he said, adding that the firm cannot say yet what printer models are impacted.

    But the Columbia researchers say the security vulnerability is so fundamental that it may impact tens of millions of printers and other hardware that use hard-to-update “firmware” that’s flawed.

    'Crystal clear'
    The flaw involves firmware that runs so-called "embedded systems" such as computer printers, which increasingly are packed with functions that make them operate more like full-fledged computers. They also are commonly connected to the Internet. 

    "The problem is, technology companies aren't really looking into this corner of the Internet. But we are," said Columbia professor Salvatore Stolfo, who directed the research in the Computer Science Department of Columbia University’s School of Engineering and Applied Science. “The research on this is crystal clear.  The impact of this is very large. These devices are completely open and available to be exploited.”

    Printer security flaws have long been theorized, but the Columbia researchers say they've discovered the first-ever doorway into millions of printers worldwide.  In one demonstration of an attack based on the flaw, Stolfo and fellow researcher Ang Cui showed how a hijacked computer could be given instructions that would continuously heat up the printer’s fuser – which is designed to dry the ink once it’s applied to paper –  eventually causing the paper to turn brown and smoke.

    In that demonstration, a thermal switch shut the printer down – basically, causing it to self-destruct – before a fire started, but the researchers believe other printers might be used as fire starters, giving computer hackers a dangerous new tool that could allow simple computer code to wreak real-world havoc.

    Hewlett Packard, in a statement, said all its printers include such thermal switches, and these would prevent a printer fire in all cases.

    "(The thermal breaker) cannot be overcome by a firmware change or this proposed vulnerability," it said.

    Click here to read H-P's full statement issued in response to this story.

    Cui and Stolfo say they've reverse engineered software that controls common Hewlett-Packard LaserJet printers. Those printers allow firmware upgrades through a process called "Remote Firmware Update." Every time the printer accepts a job, it checks to see if a software update is included in that job.  But they say printers they examined don't discriminate the source of the update software – a typical digital signature is not used to verify the upgrade software’s authenticity – so anyone can instruct the printer to erase its operating software and install a booby-trapped version.

    In all cases, the Columbia researchers claim, duping a would-be target into printing a virus-laden document is enough to take control of that person's printer; but in some cases, printers are configured to accept print jobs via the Internet, meaning the virus can be installed remotely, without any interaction by the printer's owner.

    “It's like selling a car without selling the keys to lock it,” Stolfo said. “It’s totally insecure.”

    Columbia University

    Columbia researcher Ang Cui explains how he was able to infect an HP printer with malicious code.

    Rewriting the printer's firmware takes only about 30 seconds, and a virus would be virtually impossible to detect once installed. Only pulling the computer chips out of the printer and testing them would reveal an attack, Cui said.  No modern antivirus software has the ability to scan, let alone fix, the software which runs on embedded chips in a printer.

    “First of all, how the hell doesn't HP have a signature or certificate indicating that new firmware is real firmware from HP?” said Mikko Hypponen, head of research at security firm F-Secure, when told of the flaw. “Printers have been a weak spot for many corporate networks.  Many people don’t realize that a  printer is just another computer on a network with exactly the same problems and, if compromised, the same impact.”

    There are plenty of points of contention between HP and the researchers, however. Moore, the HP executive, said the firm’s newer printers do require digitally signed firmware upgrades, and have since 2009. The printers tested by the researchers are older models, Moore said. 

    In contrast, the Columbia researchers say they purchased one of the printers they hacked in September at a major New York City office supply store.

    Moore also said that the impact of any potential vulnerability is limited because most home users have InkJet printers – not LaserJet printers – and they do not permit remote firmware upgrade, he said.

    Still, a widespread flaw in LaserJet printers would raise serious issues. Hewlett Packard dominates the printer market; the firm says it's sold 100 million LaserJet printers since 1984, meaning millions of computers could be vulnerable. HP, by far the dominant printer seller worldwide with 42 percent of the market, sells about 50 million printers of all kinds annually, according to IDC.

    In an exclusive demonstration for msnbc.com at Columbia University’s Intrusion Detection Systems Laboratory, Cui and Stolfo revealed the kind of havoc an attacker could wreak once they gained control of a printer. After sending a virus-laced print job to a target printer, the device's small screen read, in sequence, "Erasing...Programming...Code Update Complete."

    In one demonstration, Cui printed a tax return on an infected printer, which in turn sent the tax form to a second computer playing the part of a hacker’s machine. The latter computer then scanned the document for critical information such as Social Security numbers, and when it found one, automatically published it on a Twitter feed.

    A hacker who merely wanted to wreak havoc could easily disable thousands – or perhaps millions – of vulnerable printers, Cui said, as it is trivial to send the printer upgrades that would render it inoperable.  

    Beachhead?
    But the researchers say the possibilities created by hijacked printers go far beyond pranks or identity theft. Printers on a company network are nearly always trusted by other computers. A hijacked printer could act as a beachhead to attack a company's network that was otherwise protected by a firewall. Few companies are prepared to protect themselves from an attack by their own printer.

    Moore also disagreed with this assertion. He said standard print jobs could not be used to initiate a firmware upgrade; only specially-crafted files sent directly to the printer can do that. Were that true, the vulnerability could only be exploited on printers left exposed to the Internet; printers behind a firewall would be safe.

    “This (vulnerability) is probably not as broad as what I had heard in their first announcement,” Moore said. “It sounds like we disagree on what the exposure might be.”

    But the Columbia researchers say standard print commands sent both from a Macintosh computer and a PC running Linux tricked an HP printer into reprogramming itself. Moore later conceded that might be true; but the two sides disagreed on whether users in a Microsoft Windows environment were safe from the attack.

    Even home users with printers that are not directly connected to the Internet are at risk, Cui said.  As long as the printer is connected to a computer – through a USB cable, for example –  it could be used to launch attacks, or as part of a botnet.

    A quick scan of unprotected printers left open to Internet attack by the researchers found 40,000 devices that they said could be infected within minutes. 

    Cui discovered the lack of authentication by physically disassembling the printer, and painstakingly reading output from its chipset, one character at a time. The chips run off-the-shelf operating systems like VxWorks and Linx, a scaled-down version of the Linux operating system designed for embedded devices.  Reprogramming the chip was relatively easy, he said – and now that the concept has been proven, he thinks others could reproduce his work in a day or two. 

    "In fact, it's almost impossible to think that someone else hasn't already done this," he said.

    Fixing the flaw will not be easy, Stolfo said.  There is no natural path to update printer operating system software, as there is for desktop PC software.  It's possible a consortium of firms could "push out a fix," once one is available, he said. He urged HP to work with companies like Microsoft to help consumers update their printers. (Msnbc.com is a joint venture of Microsoft and NBC Universal.)

    One particularly vexing part of the fix: Printers that are already compromised by rogue software likely cannot be fixed. An attacker could easily shut down the pathway for future updates that would “cure” an infected printer.

    “If and when HP rolls out a fix, if a printer is already compromised, the fix would be completely ineffective.  Once you own the firmware, you own it forever. That’s why this problem is so serious, and so different,” Cui said. “This is nothing like fixing a virus on your PC.”

    Such inability to help consumers manually secure their printers could ultimately have disastrous consequences, Stolfo said.

     “It may ultimately lead to telling everyone they just have to throw their printers out and start over,” he said. "Fixing this is going to require a very coordinated effort by the industry," Stolfo said.

    Rogue software
    Hypponen said that the anti-virus industry could develop software tools that would detect booby-trapped print jobs in word processing documents or emails, and thwart attempts to update printers with rogue software that way. But such an approach would hardly be foolproof.

    The Columbia researchers are just beginning to sample printers sold by other manufacturers; the research is inconclusive so far, but Stolfo and Cui believe the problem is not limited to Hewlett-Packard machines.

     “I think it is very wise to broadcast the problem as soon as possible so all of the printer manufacturers start looking at their security architectures more seriously,” Stolfo said.  “It is conceivable that all printers are vulnerable. …Printers that are 3-, 4-, 5-years-old and older, I’d think, all used unsigned software. The question is, ‘How many of those printers are out there?’ It could be much more than 100 million.”

    That’s why Stolfo and Cui decided to go public with the vulnerability: They believe the sheer scope of the flaw requires immediate attention and cooperation from multiple elements of the tech industry. The two are currently helping HP devise a mitigation strategy.

    HP continues to research the potential flaw, but it’s too early for the firm to announce which products might be impacted, or what consumers should do.

    “Until we know things like whether Windows users are affected, whether this is a class or specific product issue, it is frankly irresponsible to say more,” Moore said.  “If this turns out to be the broad (problem) that's being discussed…we will reach out to customers and get it fixed.  We support our customers and value their trust.”

    Printers, however, are just the tip of the iceberg when it comes to vulnerable embedded devices, Stolfo warned.  Columbia researchers have found that many gadgets now wired to connect to the Internet – including DVD players, telephone conference tools, even home appliances – have no security at all.

    "Right now, very few people are thinking about the security of all these devices, so we're moving on to look at many more of them,” Stolfo said, noting that supposedly secure offices – even in sensitive government agencies – have networked teleconferencing devices, printers, even thermostats that create security risks.

    “This is a whole area that is being ignored,” he continued. “While most folks are focused on applications, there is a comfort level with (embedded systems) that is nonsensical. There's no focus on the security of these devices we take for granted and we carry into secure environments every day.”

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Can't afford to retire in the US? There's always Panama

    Carol Denne and her husband Larry both worked government jobs for decades, but as they entered their late 50s, Larry's fast-shrinking 401(k) account and Carol’s modest pension pointed to one stark reality: Retiring with dignity in their Philadelphia suburb would be impossible. In fact, Carol ran the numbers over and over and came to the conclusion that retiring anywhere in the U.S. was unrealistic.

    "Either my husband was going to have to work until he died, or we were going to have to leave the country," she said.  "He'd been working since he was 15, and that was long enough.  So we left."

    So four months ago, Carol and Larry departed the U.S. -- leaving behind their four children and five grandchildren -- and moved to a mountain village in Panama.

    "We found we could live on my retirement here," Carol said by phone from their new home outside the town of David, on the Latin America's country's west side. They were surprised to find a healthy number of "gringos" already living in their suburb, called Volcan.  "We are seeing a growing number of 'ex-pats' who are in our same situation. This points to a growing number of families that are torn apart as parents and aunts and uncles are forced to move away to retire.”


    They pay $500 per month to rent a four-bedroom home, enjoy dinners for $10, and now believe they'll be able to live out their lives without worrying about running out of money.

    With Larry 59 years old and Carol 57, the Dennes fit into the demographic that might actually be suffering the most during the current economic downturn.  While much has been written about youth who graduate college and have few economic opportunities and families threatened with foreclosure, both groups will presumably benefit when the economy rebounds -- even if the recovery is 10 years off.  But for workers nearing retirement, there is no time to make up their share of the $2.7 trillion in retirement investments that vanished between 2007 and 2009, according to the Urban Institute.

    As we’ve chronicled here before on Red Tape, older Americans who lose their jobs have a hard time finding new employment. Many unemployed 50-somethings believe ageism is a factor, and there is some data that might support those accusations. The unemployment rate for workers aged 55-64 has more than doubled, from 3 percent in 2006 to 7.1 percent in 2010, according to a recent report by Congress’ Government Accountability Office. Median unemployment length for the group soared from 11 weeks to 31 weeks from 2007 to 2010. The report also found that an estimated 25 percent of adults 50 and over had exhausted their savings in response to a layoff or other recession-related event, and half in that age group say they had delayed a medical or dental procedure to make ends meet. Meanwhile, the normal safety net of home equity has been decimated by the housing bubble collapse.

    Things were different for the Dennes before 2008, before the economic crash caused by the near collapse of the financial system. Larry was a manager at a local recycling company and had dutifully socked away money into his 401(k). Between her $3,000 per month pension earned as a civilian working for the Navy and his retirement savings, the couple thought they'd have options. Then, the crash swept away most of Larry's 401(k) and reality hit.   

    "I'm angry about that, angry that was situation we were faced with. It was difficult leaving friends and family behind," Carol said. "We didn’t have that much to start with. To lose all that was a big deal."

    The couple had never been to Latin America, and spoke no Spanish, but they were desperate for options and attended a seminar on retiring in Panama.  They were hooked.

    "Our friends couldn't believe we were going to do that," Carol said.

    It's a conversation that's being repeated around the country. Solid data on the number of U.S. retirees is hard to find, but the trend seems on the rise.  The Social Security Administration paid benefits to 509,000 overseas retirees in 2008, the most recent available data. That's a sharp uptick from the 396,000 who received benefits in 2000.

    The economics seem irresistible.  Housing costs in places like Ecuador, Mexico and Panama are a fraction of those in the U.S. Many Latin American countries offer retirement benefits and health care to U.S. ex-pats living there.  And the pace of life is hard to beat.

    "We live in an eternal spring," Carol said.  "We’re in the mountains, where the temperature is always around 75 or 80. It never snows. There's no leaves to rake in the fall, no shoveling in the winter. It's absolutely beautiful here."

    Panama regularly ranks among the top places for ex-pats to retire when magazines like International Living or organizations like AARP conduct surveys. International Living ranked Panama third globally, behind only Ecuador and Mexico, in a survey that weighed cost of living, health care, culture, infrastructure, etc. (The U.S., by the way, ranked 22nd, just ahead of Slovenia and the Dominican Republic). Panama's "pensionado" program also offers deep discounts to seniors on everything from prescription medicine to food and airline tickets.

    Those will come in handy, as the couple has plans to return to the U.S. frequently to see their children and grandchildren. Meanwhile, a steady stream of visitors is coming to their piece of paradise.

    "We've already had one daughter come down, and another one is coming in January," Carol said.

    Technology helps keep them connected with home -- Facebook, email, and Skype make it relatively easy to keep up with friends and family.  Of course, it's not flawless. I had to dial the Dennes’ phone number six times before the call went through. Other ex-pats on bulletin boards devoted to life in Panama complain that electricity and water services aren't always reliable.  But such hiccups are part of life in Panama, Carol said.

    "You learn to go with the flow," she said. "The pace of life is different."

    The couple has already adjusted, for the most part, Carol says. 

    "I miss nothing. Maybe the convenience having so many stores nearby," she said.  A painter, she has to travel about 45 minutes to buy supplies like acrylic paints.

    But that's not going to change, as the couple plans has no plans to return to the U.S.

    "We're down here for the long haul. We can't afford to live in the States," she said. "My sister is older, she has a good job, and she's going to have to work 10 years before she retires.  I'm shocked that that has happened. I don't know what's going on. Boomers are working even longer, or until they die, or are leaving country like we are. The recession has affected everybody in hard ways."

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Netflix users offered pennies by Wal-Mart to settle collusion charges

    Netflix subscribers are being offered a $27 million payment by Wal-Mart to settle a class action lawsuit that alleges the two retail giants violated federal antitrust laws by agreeing to stop competing with each other in 2005.

    At the time, Wal-Mart agreed to get out of the DVD-by-mail rental business and, in exchange, Netflix agreed to stop selling discs and promote Wal-Mart’s DVD sales. A press release about the arrangement from 2005 says Wal-Mart rental customers were offered a chance to transfer their memberships to Netflix for one year at the lower Wal-Mart price.

    The settlement was revealed in an email sent to Netflix subscribers on Wednesday, and covers anyone who paid fees to Netflix between May 2005 and September 2011. Wal-Mart has not admitted wrongdoing.

    But consumers, who claim they've already been wronged because DVD rental prices remained artificially high from the arrangement, won't benefit much from the settlement. After $7 million for attorney's fees, and an additional $2 million for expenses, are paid, less than $1 each will remain for the 25 million current and former subscribers covered in the class.

    Consumers have until Feb. 14 to opt out of the settlement.  Those who remain in the class will receive their payouts via gift card.

    That doesn't sit well with Netflix subscriber Christopher Ambler.

    "The lawyers get double-digit millions of dollars and the consumers get a few bucks on a gift card," he said. "All this does is raise prices for consumers to pay for the lawyers getting a big bonus."

    As is often the case in what are sometimes called "coupon" class action settlements, Wal-Mart could actually benefit from the settlement payout.  The small gift cards it would send to consumers would entice them to visit Wal-Mart stores, similar to a marketing campaign.

    A judge must still approve the Wal-Mart settlement; the final hearing is slated for March 14 in a federal court in Oakland, Calif.

    Netflix, also named in the lawsuit, is taking a different legal strategy, with lawyers so far signaling they plan to allow the lawsuit to go to trial, scheduled Jan. 23 in a federal court in California. Netflix's lawyers have argued that the Federal Trade Commission found nothing wrong with the agreement it made with Wal-Mart.

    More details on the lawsuit are available at www.OnlineDVDclass.com

     Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Using a credit card induces euphoria, new research shows

    Credit cards take us out of our right minds, inducing a kind of euphoria that makes people ignore the downsides to purchases, suggests a new study in the Journal of Consumer Research

    Like a starry-eyed new lover who ignores the downsides of an obviously incompatible but very attractive partner, consumers who swipe plastic when they buy are often blinded to the true costs of their purchases.  They even tend to exaggerate the perceived benefits of whatever they're buying, according to research by Promothesh Chatterjee of the University of Kansas and Randall L. Rose or University of South Carolina.

    To put it another way: Buying things with credit cards is more like lust than love.


    Buying with cash, however, makes people focus on the pain of a purchase -- not just the costs, but other downsides of the purchases, such as a product's limitations.

    “Our research suggests that, when it comes to product evaluation, beauty truly lies in the eyes of the cardholder,” the authors say in the report.

    The research might help consumers get a better grasp on why they seem to overspend when using plastic. It has broader social implications, too, particularly as new and even more-frictionless payment systems like Google Wallet enter the marketplace. 

    It also may help consumers understand exactly how large corporations are trying to exploit their behavioral weaknesses, so they can develop their own personal counter-measures.

    It's long been observed that consumers spend more when paying with plastic than cash, a phenomenon known as the "credit card premium." But there hasn’t been much research devoted to why, said Chatterjee. It's generally been presumed that consumers who feel the pain of dollar bills leaving their hands spend less than those who zoom through checkouts with just a swipe. But Chatterjee argues that something much deeper is going on.

    "The effects of credit cards go far beyond increasing consumer spending power and shifting consumption from the future to the present; fundamental product perceptions are affected as well,” Chatterjee says in the report.

    Researchers primed subjects using traditional behavioral study methods, such as making them play words games which focused their attention either on credit cards or on cash. Then they gave the consumers information on items they could theoretically buy, such as a notebook computer or an iPhone.  Repeatedly, consumers "primed" to think about credit cards had a harder time recalling products’ price or other downsides.

    “Our findings suggest that marketers may be affecting not just the amount of money consumers are willing to spend but also the nature of the goods and services that find their way into consumers’ market baskets,” the report says

    'I keep buying things I don't really want'
    Chatterjee said he become interested in the field after he observed his own behavior with regards to credit cards.

    "I hardly ever carry cash and as a consequence I keep buying things I don't really want,” he said. “I'm not even thinking about the cost, I'm so consumed with the benefit of what I’m getting. It has been bugging me for a long time. People do not realize how their payment mechanism influences behavior."

    The research is even more relevant as new "touchless" forms of payment become common, such as cellphone payments like Google Wallet, enabled by Near Field Communications chips. 

    "The pain is missing," when consumers make such effortless payments, Chatterjee said. And that prevents them from engaging in an otherwise normal cost-benefit analysis before they acquire things, he said.

    "(New electronic payments allow) consumers to make payments without a lot of deliberation. ...This arrangement, ostensibly for the consumers’ convenience, seems to offer an even more powerful disconnection of spending from payment," Chatterjee said.

    Retailers have conducted high-level research on consumer behaviors for decades, of course.  For example, something as simple as making product containers taller distorts consumers' perceptions of volume, and therefor compromises their ability to comparison shop.

    But credit card euphoria is so powerful because it can impact literally every kind of purchase, the new research indicates.

    Something as simple as the display of a MasterCard or Visa logo on a cash register could actually nudge consumers to buy more stuff, Chatterjee thinks.

    "If we can somehow put that pain back in, we could perhaps retain the convenience of plastic, which at the same time help consumers make more informed decisions,” he said. Perhaps a simple reminder at the point of sale -- an image of cash, or a cell phone reminder of a bank account balance -- could tip the scales closer to normal for consumers.

    The research could also inform government agencies distributing social welfare payments. Most now use some form of pre-paid debit card for unemployment payments and other benefits.  It's possible that might be encouraging poor spending habits.

    As an antidote, Chatterjee suggested that consumers set aside money separately for gifts, or vacations -- a method that recalls old Christmas club savings accounts.

    "It's old-fashioned, but it works really well,” he said. “A lot of research shows that when you earmark money for this or that, people see that money as out of bounds and don't touch it until they use it for the intended purpose. The thing I want to tell consumers is to be cautious when paying with credit cards.”

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Congress takes up controversial anti-piracy SOPA legislation

    Congress began debating Wednesday another controversial effort by the movie industry and other content makers to stem Internet piracy through federal legislation. The measure, known as SOPA, for Stop Online Piracy Act, would empower the nation's attorney general to tell search engines and other Internet providers to stop sending Web surfers to alleged piracy sites, a measure opponents describe as "an Internet blacklist."

    The Electronic Frontier Foundation calls the proposal "the most extreme, anti-Internet, anti-privacy, anti-free speech copyright proposal in U.S. legislative history."

    Some websites, such FreePress.net, turned themselves black on Wednesday to protest the legislation, which was discussed in a House Judiciary Committee hearing. 

    A coalition of rights holders, including the U.S. Chamber of Commerce, supports the effort, and claims that advocacy groups are overreacting to the legislation's provisions. It claims the law would not create a blacklist.

    “Websites that blatantly steal the creativity and innovation of American industries violate a fundamental right to property,” Thomas J. Donohue, CEO of the U.S. Chamber, said when the legislation was introduced. “Operators of rogue sites threaten American jobs, endanger consumer safety and undermine the vitality of the online marketplace." The coalition claims that "rogue sites" attract 53 billion visits per year, jeopardizing the more than $7.7 trillion of U.S. gross domestic product.

    This battle of titans pits consumer groups and tech firms like Google, Facebook, and eBay against much of Hollywood.

    The legislation would allow the U.S. attorney general to order pirate websites be cut off through alternations to entries in the Domain Name System (DNS), a process opponents call blacklisting. It also creates mechanisms for content owners to tell payment processors like Visa and MasterCard to stop processing payments for alleged offending sites.

    The DNS proposal is most offensive to technology firms.  Andrew Lee, CEO of security firm ESET, compared the technique to the "clickjacking" tools uncovered recently by FBI agents that hackers used recently to steal $14 million worth of advertising. In that scam, computer criminals allegedly altered DNS instructions to place rogue advertisements on major websites like ESPN.com, then collected the commissions.

    "(SOPA) would require DNS server operators in the US to replace the correct IP address for a website with an alternate address provided by the Attorney General's Office if the website was ‘infringing,'” he wrote in an open letter to Congress. "While we are all in favor of stopping piracy, messing about with DNS and legalizing state-controlled DNS changing seems like overkill."

    But Michael O'Leary, policy chief for the Motion Picture Association, rejected complaints that the law would harm consumers or stifle innovation.

    "You and your colleagues have heard a great deal from those who suggest this bill, and our efforts to fight online theft, will 'break the Internet,' or harm legitimate online social media platforms and Internet services," O'Leary said, according to a written version of his testimony published by CNet.com. "Nothing could be further from the truth." 

    He went on to complain that the current system for removing content that violates copyright -- governed by the Digital Millennium Copyright Act, or DCMA -- doesn't work with rogue websites that ignore the law. He argued that law enforcement officials already have the right to redirect traffic away from criminal websites, and that suspected pirates would have access to due process to appeal DNS changes.

    No date for a Judiciary Committee vote on the legislation, or on its companion PROTECT IP Act in the Senate, has been announced.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • After 16 hours on air at Wall Street protests, a Ustream star is born

    Bob Sullivan / msnbc.com

    Tim Pool at Zuccotti Park.

    The revolution will be Ustreamed. 

    When police ran Occupy Wall Street protestors out of Zuccotti Park in the middle of the night on Tuesday, there was really only one way to watch it live: On Tim Pool's "TheOther99" video stream. Pool, armed only with a cellphone and donated backup batteries, filmed the event through the night. He hosted the coverage news anchor style, the way Brian Williams would, talking almost continuously, stopping occasionally to conduct interviews.

    It might have looked a bit like grainy home video, but Pool had a sizable international audience. His Ustream.TV "channel" had, at various times, more than 20,000 simultaneous viewers, an audience some cable channels might envy. The audience exploded when word went out across Twitter that Pool’s stream was the best way to watch the protests online.

    When I met Tim Tuesday afternoon, he'd been "on the air" continually for nearly 16 hours. And while plenty of video streams have come and gone during the protests, Pool’s broadcast earned him a lot of credibility with protesters, and he was still going strong into the evening.

    "Other than my hand cramping up from holding up the phone, I feel pretty good," he said.  He hadn't gone dark, or gone to the bathroom, that entire time.  "I do really need a piece of fruit, though," he added.

    Pool, from Chicago, has been at the Occupy Wall Street protest from the start. He said had no experience hosting a TV show or live stream, but honed his ability to fill air time with talk during the past two months while documenting the protest. Anyone -- including police officers and foul-mouthed protesters -- who walked near Pool risked being broadcast instantly to the world. 

    Pool spent most of the time Tuesday morning running after crowds of evicted protesters as they tried to reorganize, or showing live video of sanitation workers gathering tents and other personal items in the park for disposal.  He rarely turned the camera on himself.

    "I'm here to document what's going on," he said. "I've been doing this since the beginning."

    Bob Sullivan / msnbc.com

    Tim Pool uses simple equipment to "broadcast" live video of the protest on the Internet.

    What Pool’s doing is vaguely similar to what’s called “lifecasting,” where individuals chronicle their lives online through a continual video stream or similar real-time techniques.  The difference is this: Pool’s all-night broadcast on Tuesday morning was riveting.

    The quality of his video stream -- both in content and technology -- is surprisingly good. And the simplicity of his gear can't be beat. He's using a Samsung Galaxy S2 on Sprint's 4G network to stream video, using the onboard camera and microphone to record, and connecting the phone to a small but powerful backup battery.  If you want to know, it’s an "Energi to Go" 18,000 battery produced by Energizer which provides 18,000 milliamp hours (roughly 10 cell phone charging cycles). When his backup battery drained dangerously low, he put out a plea for help on his stream and received two more donated batteries.

    "That's why I've been able to keep doing this long," he said.

    Perhaps the most complicated part of his video gear was the umbrella he had to raise to protect his gear Tuesday night when rain began falling in lower Manhattan. But by that time, police had allowed protesters back into Zuccotti Park, and Pool wasn't about to let a little rain get in the way of his broadcast.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Why fine print might ground your high-flying 4G cellphone service

    Mark Rasch is dying to get in on the super-fast 4G cellphone networks he keeps hearing so much about.  Advertisements with streaming movies, live sports, even lightning bolts that help create stirring multimedia experiences on the go have been tempting him for more than a year.

    An AT&T customer, he was thrilled last week when the firm released its first two "real" 4G LTE phones -- the HTC Vivid and Samsung Galaxy S II Skyrocket. A Washington, D.C.,-area resident, he's lucky to live in one of the handful of cities where the providers' highest-speed service is currently available, so he was ready to jump in with both feet.

    Then, he read the contract.  


    It says this: "Data sessions may be conducted only for the following purposes: (i) Internet browsing; (ii) email; and (iii) intranet access."  Nothing about lightning bolts, and according to Rasch, nothing that he can't already do with his old phone. He found the limitations troubling.

    "If you buy these phones thinking that you can use them, any of the thousands of Android apps, and the LTE data network for a host of really cool things like making VOIP calls, using Skype, streaming audio or video, remotely accessing a home PC, accessing cloud services, or any of the thousands of things that such apps enable, think again," he said. "In effect, you are buying a fully enabled phone, crippled by AT&T’s Terms of Use."

    The new AT&T 4G LTE service, promising download speeds of 5-to-12 Mbps, could be incredibly attractive to consumers because that much bandwidth is almost enough to permit streaming of HD movies or sports to big living room flat-screen televisions, while leaving enough headroom for other family members to still surf the Web.  It theoretically could replace the need for a hard-wired Net connection, and make that home broadband connection completely portable – but not if providers saddle the service with restrictions.

    This holiday shopping season will be the first that all four major cellphone providers will be hawking their faster 4G networks. But Rasch is concerned about the long list of activities that appear to be prohibited by AT&T's terms of service. While such restrictions are not new for 4G, they are far more relevant -- why pay for a high-bandwidth phone if not for high-bandwidth activities?

    "AT&T promotes and advertises all the ‘cool’ things their devices can do,” said Rasch, a digital law consultant and the former head of the Department of Justice's computer crimes unit. “You can download apps, listen to radio stations, stream TV, watch movies, play games with third parties, share data, log into your home PC, do real-time GPS, get traffic and weather reports, and thousands of other things. But only, according to the contract, on WiFi. To me, advertising and promoting services that you know you don’t offer in the way that people are likely to use them is ... false advertising."

    AT&T, in an e-mail statement, didn’t directly address Rasch’s complaints, but it did say that its new phones offer rich experiences to users, including apps with video, and that it continually works to balance bandwidth demands to keep its network running smoothly.

    "Our (terms of service) help us ensure the efficient use of limited wireless spectrum and strong network performance for all customers," the firm said. "A variety of video apps, including Sling, Netflix, YouTube and others, are optimized for use on wireless networks, and are available for AT&T customers today.  Among other things, this optimization ensures a quality experience for the customer without excessive data usage. We are committed to working with apps developers to help them to optimize apps for use over our wireless network." 

    The firm did not answer requests for clarification about individual elements contained in its terms of contract, responding simply: "We’re comfortable with our terms of service and the many ways customers use AT&T’s mobile broadband network.”

    So does AT&T’s terms of service contract for new high-speed wireless gadgets throw a wet blanket on consumers, or not? The difference may be mere semantics at the moment – AT&T appears to allow many of the activities that Rasch believes are restricted by the terms of service. And at the moment, AT&T’s 4G LTE service only works in Boston, Washington, D.C., Baltimore, and Athens, Ga. It will turn on LTE in six more cities next week, and hopes to reach a total of 15 cities by the end of the year.

    But Michael Weinberg, staff attorney at consumer advocacy firm Public Knowledge, says the semantics matter.

    "(The contract) does read incredibly restrictive, essentially, only Web browsing and email.  Is downloading apps using one of those two things? Playing Scrabble?” Weinberg said.  “The classic definition of Internet browsing is things done in a browser. This is another example of a terms of service written in a way that has traps …  that can be pulled up to stop people doing things (the company) doesn’t like."

    The new 4G -- for "Fourth Generation" -- cellphone standard is off to a rocky start.  Promising speeds that rival fast, hard-wired home Internet connections, 4G phones create possibilities such as streaming full-screen HD movies in the back seat of a moving family minivan. But carriers have co-opted the term 4G, turning it into catch-all phrase that includes refer to lower-speed networks such as AT&T's HSPA+.  Marketplace confusion reigns – the new 4G LTE phones released by AT&T this month are the providers first “real” 4G entrants. And, early 4G users on all networks report it doesn’t really provide video streaming nirvana.

    Meanwhile, bandwidth caps render true 4G devices essentially useless, some critics say.  A report by Public Knowledge published in Augustsaid that users streaming at top 4G speeds would use up a typical 2 gigabyte monthly bandwidth allotment after watching just 3 hours of a Netflix movie or uploading two 10-minute HD movies. Since then, basic capped plans have risen slightly, and data plans let users pay for more bandwidth, but the costs quickly become prohibitive.

     "They promise unlimited possibilities. However, they will deliver little except anxiety and disappointment to millions of consumers who will pay extra for speeds they cannot use for fear of running over their data cap," the group said in its report, which concluded that 4G services are "a waste of money. … For the perhaps first time, the introduction of a generationally faster technology will not have a widespread impact on online behavior."

    Cellphone service providers must perform a delicate dance with each new network rollout. On one hand, they have to brag about great new features and capabilities, but at the same time they must avoid creating a gold rush that clogs their networks and avoid inviting network abuse.  High overage fees are the most practical way to stop bandwidth hogs from degrading fragile high-speed networks, but restrictive usage contracts are a handy legal arrow to have in the quiver.

    AT&T's been down this road before. In 2009, the firm temporarily blocked usage of the popular Slingbox streaming TV service. It was restored nearly a year later, when the two firms reached an agreement that helped AT&T manage network usage.

    AT&Ts current 4G and 3G contracts contain language that appears to restrict usage of the Slingbox by its subscribers. The terms clearly prohibit "redirecting television signals for viewing on Personal Computers,” for example.

    But Jay Tannenbaum, Slingbox spokesman, said that the Slingbox app works just fine on AT&T's network, and he doesn’t anticipate problems with the new 4G LTE service.

    "We have no problems with any carrier," he said. "We try to be good network citizens and work with the bandwidth we have. ... We have had no problems with our data being limited on any network."

    Net neutrality advocates worry that a provider like AT&T could choose to discriminate against a specific application like Slingbox and favor its own flavor of the same tool. But the terms of service issues raised by Rasch don’t suggest any underhanded attempt to gain a market advantage; they sound more like an effort at self-preservation. Many activities expressly forbidden in the AT&T contract are illegal anyway, and much of the language is standard across many carriers.

    But the restrictive nature of AT&T's contract does stand out.  For example, AT&T language says, "data sessions may be conducted only for the following purposes," and then lists browsing, email, and intranet access.

    Verizon's terms of service puts it this way: "You can use our Data Services for accessing the Internet and for such things as: (i) Internet browsing; (ii) email; (iii) intranet access ... (iv) uploading, downloading and streaming of audio, video and games; and (v) Voice over Internet Protocol (VoIP)."

    T-Mobile's contract falls somewhere in between. It reads: "Your Data Plan is intended for Web browsing, messaging, and similar activities on your Device and not on any other equipment. Unless explicitly permitted by your Data Plan, other uses, including for example, using your Device as a modem or tethering your Device to a personal computer or other hardware, are not permitted.

    Sprint’s contract merely prohibits illegal activity, or “excessive utilization of network resources.”

    AT&T’s restrictive list of unwelcome behaviors offers considerable detail.

    “Examples of prohibited uses include, without limitation, the following: (i) server devices or host computer applications, including, but not limited to, Web camera posts or broadcasts, automatic data feeds, automated machine-to-machine connections or peer-to-peer (P2P) file sharing; (ii) as a substitute or backup for private lines, wirelines or full-time or dedicated data connections,” it reads.

    AT&T's lawyers are grabbing as much legal ground as they can to support any possible usage challenge, Rasch said, "to make it easy for them to enforce their rights at some later date." 

    The problem is, even if the contract isn’t functionally restrictive, it raises doubts about the future Rasch argued.

    "Show me where in contract it says I can use Slingbox, unless you consider Slingbox to be Internet browsing, which is absurd,” Rasch said. “And is FTP use Internet browsing? The problem is they can decide at any time that doing these things is a violation of their terms of service and terminate you, and you would have no legal recourse."

    The real problem with such assertive language, even if it's loosely interpreted, is the chilling effect it could have on mobile broadband technology, said Michael Weinberg, staff attorney at Public Knowledge.

    “If i am the kind of consumer who tries to stay on the right side of the law, I could read this and worry – should I use my Slingbox? Will I wake up one day and find it's been cut off?” he said.  He conceded that there are good reasons to terminate network abusers, and that there’s nothing wrong with AT&T’s decision to spell out restrictions in detail. 

     “But they talk about things like web broadcasting, saying you can’t do that. But web broadcasting is really an undefined term. You can download an app right now that lets you use your phone to broadcast what’s going on to the world using your phone. Why should that be restricted? We don’t even know what that will turn into,” he said. “This is a classic problem a terms of service policy where they reserve the right to cut people off. They don’t necessarily enforce it, but it’s there if they need it.” 

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).

  • Email voyeurs are everywhere, as mayor finds out the hard way

    An amazing tale of political corruption and breach of trust has arrived courtesy of scandal-ridden Hoboken, N.J., in case you needed a reminder that electronic voyeurs of many stripes might be reading your email. The town's information systems specialist allegedly set up a system to intercept all email going to or from Hoboken's mayor, and apparently made copies of the private notes for potential political opponents. The news was first reported in Hoboken's Patch.com Web site.

    It's an open secret among IT workers that many find casually snooping on co-workers’ emails just too tempting. In a 2008 survey conducted by security firm Cyber-Ark, one in three "senior IT professionals" said they'd spied on co-workers’ email. This year, Cyber-Ark asked a slightly different question:  "Have you ever used an administration password to access information that is otherwise confidential or sensitive?" One in five North American respondents said they had, as did one in three in Europe, the Middle East, and Africa.

    It's hard to imagine a more sensitive example of IT data snooping than the Hoboken e-spying incident alleged by federal prosecutors.

    The accused IT worker, Patrick Ricciardi, 45, is a longtime municipal employee. The current mayor, Dawn Zimmer, came to power in 2009 after a wide-ranging scandal involving the previous mayor, Peter Cammarano, who resigned from office in disgrace and received a 24-month prison sentence after an FBI corruption sting that netted 60 area officials.

    In April, employees of the mayor's office became suspicious that emails were somehow being leaked after information in private messages began appearing in local media and on websites devoted to town politics.  In May, according to Patch.com, FBI agents raided Town Hall and left with computers tagged as evidence.

    Ricciardi did little to hide his tracks, according to the complaint. He's accused of using e-mail server settings to create an "Archive File" which created duplicates of every email sent to or from the mayor's account, and the accounts of other employees in the mayor's office.  That archive file was allegedly found on Ricciardi's hard drive.

    "This configuration intercepted emails as they were being sent, and placed them in the Archive File," the complaint alleges. A security audit also found that emails from the archive file had been forwarded to one current and one former municipal employee.

    The indictment says Ricciardi confessed during an interview with FBI agents to creating the email archive in early 2010. 

    The archive was created "so that he could 'spy' on the Mayor and the mayor's office employees, and determine whether his job was secure," according to the indictment.

    Electronic snooping is one of the ugly byproducts of the digital age; surveys are full of anonymous confessions from otherwise normal people turned e-spies by temptation.  In a survey released in July by Retrovo Gadgetology, 33 percent of respondents said they'd checked their lovers email or call history without their knowledge. Among young people, the trend is even more dramatic, with 47 percent admitting such snooping. 

    Spouse spying is so common that many lovers have come to expect it. But unexpected, illicit snooping by backroom IT workers that victims may not even know seems even more creepy, and more Big Brotherish. Of course, in the U.S., companies enjoy a relatively unlimited right to snoop on their employees when they are using work computers. That right doesn't extend to casual voyeurism by IT workers, but it's important for every worker to know that email is not for their eyes only.

    Don't miss the next Red Tape:
    *Get Red Tape headlines on your Facebook Wall
    *Follow Bob on Twitter. 
    *Get an e-mail newsletter with Red Tape stories (requires Newsvine registration).