Papa John's pizza chain accused of SMS cheesiness, faces $250M class action

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

US pizza chain Papa John's is in the firing line of a Seattle, Washington, law firm.

Heyrich Kalish McGuigan, PLLC specialises in litigation against SMS spammers, robocallers and telemarketers.

And the lawsuit they're bringing against Papa John's certainly sounds dramatic. The lawyers say:

"[This] could be one of the largest damages awards ever recovered under the federal Telephone Consumer Protection Act. The class action lawsuit contends that 500,000 illegal text messages were sent to Papa John’s customers across the country. Papa John’s customers could be awarded $500 or more in statutory damages for each text message."

An issue seems to be the issue of consent to receive SMS messages. According to court documents:

"OnTime4U [a co-defendant that sent out 'special offer' SMSes on behalf of Papa John's franchise holders] apparently told Papa John's franchisees that it was legal to send texts without express customer consent because there was an existing business relationship between the customers and the Papa John's restaurants."

But the litigators argue that:

"Complaints from ... customers state that they ... received text message advertisements without having given their prior consent to Papa John's or one of the franchisees."

Tricky stuff.

The court has affirmed that the class action can go ahead on behalf of complainants from all over the USA. Even if you received only a single SMS, you're eligible to join in.

Each SMS you received could, if the class action lawyers are to be believed, represent $500 in cash - enough at current prices to order in 1250 Papa's Chicken Poppers, 658 Spicy Buffalo Wings, or a gutbusting 23.5 metres of Cheesestick (20.3 metres of the six-cheese variety).

While you're chomping on your Cheesesticks (which are delivered in handy lengths of approximately 300mm, by the way), here's an interesting irony on the issue of inferred consent for electronic communications.

Heyrich Kalish McGuigan's own privacy policy in respect of email advises that:

Unless you ask us not to, we may contact you via email in the future to tell you about specials, new products or services, or changes to this privacy policy.

What do you think?

Should emails and SMSes to existing customers or contacts be treated differently? In a world of mobile devices on which telephony and internet access are just two sides of the same coin, does this make sense?

Is it OK to have an opt-out policy for your own email-based marketing but to expect others to abide by a strict opt-in policy for SMS-based offers?

Let us know by leaving a comment below...

Follow @duckblog

View the original article here

Another Romanian Accused of Hacking into NASA - Wall Street Journal (blog)

Gaining access to N.A.S.A. servers is beginning to look as if it is almost a rite of passage for some hackers, especially from Romania. It may not yet quite be a regular occurrence, but it is not totally uncommon, as Information Week reports on the latest arrest:

According to Romania’s Directorate for Investigating Organized Crime and Terrorism (DIICOT), the man, Robert Butyka, hacked into several NASA servers on Dec. 12, 2010, modified and damaged data on the servers and restricted access to them.

He apparently goes by the online handle, “Iceman”, and he follows in others’ footsteps.

Victor Faur was charged in 2006 with 10 criminal counts for hacking into more than 150 government computers, including computers used for deep space research, and causing them to display messages indicating that they’d been hacked. He’s now appealing the verdict against him. Earlier this year, a hacker with the online pseudonym TinKode exposed a security flaw in NASA Goddard Space Center’s FTP site.

IT security company Sophos’ blog Naked Security adds:

This isn’t the first time NASA has been hacked, as many of our readers will recall this is what originally got British hacker Gary McKinnon in touch with the long arm of the law.

If NASA is repeatedly being hacked to the tune of half a million dollars plus each time, shouldn’t we be asking serious questions about the security of their systems?

Information Week: Romanian Accused Of NASA Hacks

Naked Security: NASA hacker arrested, perhaps it is time for some defense?

View the original article here

Accused hacker pleads not guilty in Sony breach - Montreal Gazette

LOS ANGELES - An accused member of the clandestine hacking group LulzSec pleaded not guilty on Monday to charges of taking part in an extensive computer breach of the Sony Pictures Entertainment film studio.

Cody Kretsinger, 23, entered not guilty pleas to one count each of conspiracy and unauthorized impairment of a protected computer during a brief hearing in U.S. District Court in Los Angeles.

U.S. Magistrate Judge Victor Kenton set a Dec. 13 trial date for Kretsinger, who spoke only in response to questions from the judge.

Kenton also ordered that Kretsinger be represented by a court-appointed public defender.

Kretsinger faces a maximum sentence of 15 years in prison if convicted. He declined to comment to Reuters after the hearing.

A nine-page federal grand jury indictment unsealed in September charges Kretsinger with obtaining confidential information from Sony Pictures’ computer systems using an “SQL injection” attack against its website, a technique commonly used by hackers to steal information.

Kretsinger, who went by the moniker “recursion,” helped post information he and his co-conspirators stole from Sony on LulzSec’s website and announced the intrusion via the hacking group’s Twitter account, the indictment charges.

LulzSec, an underground group also known as Lulz Security, at the time published the names, birth dates, addresses, e-mails, phone numbers and passwords of thousands of people who had entered contests promoted by Sony.

“From a single injection we accessed EVERYTHING,” the hacking group said in a statement at the time. “Why do you put such faith in a company that allows itself to become open to these simple attacks.”

Hackers previously had accessed personal information on 77 million PlayStation Network and Qriocity accounts, the vast majority of which were users in North America and Europe, in what was then the biggest such security breach in history.

Other high-profile firms targeted by cyber attacks included Lockheed Martin and Google Inc.

View the original article here