DOJ requires AT&T to sell some assets in acquisition

The U.S. Department of Justice will require telecom giant AT&T to sell off pieces of its mobile network in parts of Louisiana and Mississippi in order to continue with its US$944 million acquisition of Centennial Communications, the agency said Tuesday. The area covered includes parts of southwestern and central Louisiana and southwestern Mississippi. If AT&T did not divest its assets in the two states, the acquisition would "substantially lessen" competition for mobile telecom services and would likely result in higher prices, lower quality and reduced network investments, the DOJ said.

The DOJ's Antitrust Division, along with the attorney general of Louisiana, filed a civil lawsuit Tuesday in U.S. District Court for the District of Columbia to block the proposed acquisition of Centennial by AT&T. At the same time, the DOJ and the Louisiana attorney general filed a proposed settlement that, if approved by the court, would resolve the competitive concerns in the lawsuit. The complaint alleges that the proposed transaction would substantially reduce competition for mobile wireless telecommunications services in each of the areas. According to the complaint, AT&T and Centennial are each other's closest competitors for a significant number of customers in eight cellular marketing areas (CMAs), as defined by the U.S. Federal Communications Commission. AT&T is the second-largest mobile telecom provider in the U.S. by number of subscribers, serving nearly 80 million subscribers throughout all 50 states, the DOJ said. Centennial is the eighth-largest mobile telecom provider in the U.S., with about 1.1 million subscribers in six states, Puerto Rico and the U.S. Virgin Islands. In 2008, AT&T earned mobile revenues of about $44 billion.

Dell details the Efficient Enterprise strategy at OpenWorld

Dell Chairman and CEO Michael Dell touted Dell's "Efficient Enterprise" strategy Wednesday at the Oracle OpenWorld 2009 conference and was joined briefly onstage by Oracle CEO Larry Ellison, who stressed that Oracle is a major user of Dell equipment as well as a partner. Standardization involves use of Intel processors, Dell explained. Dell's strategy centers on standardization, simplification, and automation.

Simplification entails making the complex simple using solutions like virtualization and storage consolidation, while automation is about streamlining service delivery and enabling self-service IT models, Dell said during a keynote presentation at the San Francisco conference. [ Also at OpenWorld, Ellison and Sun Chairman Scott McNealy lauded Sun technologies. ] He cited figures stating that of the $1.2 trillion spent annually on IT infrastructure, nearly $800 billion is spent on labor and services, while just $400 billion goes to hardware and related software. Dell stressed Intel as the industry standard. "The numbers really don't lie. [Intel] x86 is the standard architecture in the datacenter," he said. Meanwhile, just 1 percent of total business spending is left for driving IT innovation, Dell said. "We believe there's a real opportunity to drive out inefficiency and make technology work harder for our customers, and it forms the basis of what we call the Efficient Enterprise "Dell said.  He vowed that Dell would reduce $200 billion of inefficiency out of the $1.2 trillion. Dell referred to Intel versus "proprietary architectures" in promoting Intel-based systems. Our partnership just gets bigger and bigger every year," Ellison said.

Ellison briefly joined Dell to stress Oracle and Dell synergies. "We've got so many customers that are Dell customers and also Oracle customers. Oracle also is a major Dell user, with 20,000 Dell servers that Oracle uses to run its development and testing operations, Ellison said. Ellison did not address what could be a sticky predicament in that Oracle soon will own the rival Sun Microsystems hardware line if a proposed $7.4 billion merger goes through as planned. Dell technology is "working well for us," he said. Sun hardware is largely based on the SPARC CPU platform, with some Intel-based machines in the mix. Virtual machines, Dell said, are becoming key to driving workloads form the client to the cloud.

Efficient Enterprise, Dell said, is intended to enable greater spending on innovation and less on maintenance.  Enterprise efficiency also is about giving IT administrators increased visibility into deployed workloads, Dell said. Dell is driving its "virtual-ready infrastructure," he said.  The company is delivering automation and flexibility and self-service IT through cloud computing, said Dell. This story, "Dell details the Efficient Enterprise stretegy at OpenWorld," was originally published at InfoWorld.com. He cited 7-11 as one enterprise that has moved to Dell's managed services to improve service delivery. Follow the latest developments in open source at InfoWorld.com.

FCC net neutrality proposal is 'dramatic shift' in policy

U.S. Federal Communications Commission Chairman Julius Genachowski's decision to seek to formalize net neutrality rules would either bring "unconstitutional" new regulations to the Internet or a welcome "paradigm shift" in U.S. communications policy, depending on whom you talk to. Genachowski also pushed to apply the net neutrality regulations to mobile broadband providers, and he called for an expansion in existing broadband policy principles to prohibit broadband providers from discriminating against Web content and services while allowing them to engage in reasonable network management. Genachowski announced Monday that he will ask his fellow commissioners to support a rulemaking proceeding to create formal net neutrality rules that would prohibit Internet providers from selectively blocking or slowing Web content and applications.

The FCC has been enforcing net neutrality principles on a case-by-case basis since August 2005, but formal rules would ensure that application and content developers on the "edge" of broadband networks can innovate without interference from network operators, Genachowski said in a speech at the Brookings Institution. "This is the power of the Internet: distributed innovation and ubiquitous entrepreneurship, the potential for jobs and opportunity everywhere there is broadband," he said. "Saying nothing - and doing nothing - would impose its own form of unacceptable cost. It would deny the benefits of predictable rules of the road to all players in the Internet ecosystem." But some broadband providers and conservative think tanks suggested Genachowski's plan could lead to burdensome new regulations. It would deprive innovators and investors of confidence that the free and open Internet we depend on today will still be here tomorrow. The FCC is currently developing a national broadband plan and Genachowski's proposal might "change the rules of the road" before that's completed, said Ken Ferree, president of the Progress and Freedom Foundation, a conservative think tank. "I'm troubled to learn that the FCC is embarking on an exercise that would probably result in rules that are unconstitutional and almost certainly beyond the FCC's statutory jurisdiction," he said in an e-mail. "Aside from the legal issues it raises though, I find myself at a loss to understand why the administration wants to start meddling with a sector of the economy that, despite a challenging macro-economic environment, is performing pretty well by any rational standard. The FCC used its broadband policy principles to prohibit Comcast from blocking or slowing peer-to-peer traffic in a commission vote in August 2008. Comcast was glad to see that Genachowski appeared to suggest that the Internet is now free and open, Comcast Executive Vice President David Cohen said in a blog post. "Before we rush into a new regulatory environment for the Internet, let's remember there can be no doubt that the Internet has enjoyed immense growth even as these debates have gone on," he wrote. "The Internet in America has been a phenomenal success that has spawned technological and business innovation unmatched anywhere in the world. It's almost as if they are trying to turn a story of success into one of failure." Broadband provider Comcast said it welcomes a dialogue about net neutrality, but officials there questioned if more regulations are needed.

So it's still fair to ask whether increased regulation of the Internet is a solution in search of a problem." CTIA, a trade group representing mobile carriers, said it was concerned that the FCC could make rules that prohibit mobile carriers from differentiating their products and services. The Internet is a work in progress, and we really don't know what it's going to look like five years from now," he said. "We believe that new capabilities will be created by innovation in the network, and those new capabilities and innovation should not be precluded by regulation." Young said he was glad to hear Genachowski say the end result of the rulemaking has not been determined in advance. "We need to determine what are the problems that need to be fixed," he said. "What are the examples that require a dramatic change in the regulatory policy of dealing with the Internet." Until now, U.S. lawmakers and regulators have had a hands-off approach to the Internet, Young added. Genachowski pointed to limited competition among service providers as part of the need for new net neutrality rules, but competition is strong among mobile carriers, said Chris Guttman-McCabe, vice president of regulatory affairs at CTIA. "We are concerned about the unintended consequences Internet regulation would have on consumers considering that competition within the industry has spurred innovation, investment, and growth for the U.S. economy," Guttman-McCabe said in a statement. "Unlike the other platforms that would be subject to the rules, the wireless industry is extremely competitive, extremely innovative, and extremely personal." Verizon Communications supports a free and open Internet, but new FCC rules could make it difficult for broadband providers to offer security features or other innovative products, said David Young, the company's vice president for federal regulatory affairs. But Genachowski and Gigi Sohn, president of digital rights group Public Knowledge, said net neutrality rules wouldn't really be new. Over the past four years, there's been a heated debate in Washington, D.C., about the need for net neutrality rules, he said. "It is the elixir of consumer choice and competition that we have long been waiting to see firmly applied in the Internet space," Scott said. "We're going to settle this question once and for all, and we're going to deliver an open Internet for the U.S." Other companies and groups supporting Genachowski's announcement included Google, Skype, the Consumer Electronics Association, and the Computer and Communications Industry Association, a tech trade group.

Until 2005, when the FCC changed the rules, broadband providers had to operate open networks to share with competitors, Sohn said. "American Internet users should be celebrating today," Sohn said. "After four years of regulatory uncertainty, the FCC chairman announced that the agency will start a proceeding to adopt rules that will ensure an open Internet on every single broadband platform." Ben Scott, policy director at media reform group Free Press, called Genachowski's announcement a "paradigm shift" in FCC policy that will ensure the health of the Internet. Senator Byron Dorgan, a North Dakota Democrat, also welcomed Genachowski's plan. This principle of open access has been the cornerstone of the Internet's growth so far, and is vital to its continued success in the future." Dorgan has pushed for net neutrality legislation in the U.S. Congress. "An open and democratic Internet is necessary in order to allow innovation, economic opportunities, and consumer benefits to flourish, and it is critical that we maintain this access," Dorgan said in a statement. "By ensuring that consumers and online businesses can use the Internet without interference from broadband service providers, net neutrality will prevent the advent of haves and have-nots.

Benioff plays nice to Oracle at OpenWorld

Attendees packed into a presentation by Salesforce.com Chairman and CEO Marc Benioff at Oracle's OpenWorld conference Tuesday, but those hoping the executive would deliver some of his trademark trash talk toward Oracle left the room disappointed. But Benioff made no response to Ellison's jibes on Tuesday, instead referring to the companies' "fantastic relationship" and thanking Oracle for being "magnanimous" enough to let Salesforce.com appear at OpenWorld. Some sort of throwdown seemed possible, even likely, given that during a shareholder meeting last week, Oracle CEO Larry Ellison mocked Salesforce.com's offering as a "little itty-bitty application" that is dependent on Oracle's own technology.

Salesforce.com is a sponsor of the show. Since then, the two executives have repeatedly slammed each other's business model, with Benioff declaring on-premise software a dying model and Ellison famously mocking cloud computing on a number of occasions, even as his own company tests those waters. Ellison was an early investor in Salesforce.com, but left the vendor's board after he and Benioff had a falling out. Their history caused surprise and curiosity among some observers, who questioned why Oracle would allow such a direct rival to tout its products at OpenWorld. And during the shareholder meeting, Ellison said he could provide a long list of customers who once used Salesforce.com but "chucked it out" in favor of Oracle's own on-demand CRM (customer relationship management) software.

Indeed, beyond slamming Salesforce.com's technological achievements, Ellison has made it a point during recent earnings conference calls to cite deals it won against the on-demand vendor. But in the end, Benioff seemed more intent Tuesday on building bridges than burning them. The two companies announced a partnership on Monday for selling Salesforce.com CRM and related services to small and medium-sized businesses. At one point, he was joined onstage by Dell CEO Michael Dell. Salesforce.com and Dell already had close ties, having used each other's products for some time. Dell said its experience running Salesforce.com will give it an edge when working with new customers.

SETI@home in spotlight after IT chief loses job

Reports this week out of Arizona about how a public school district IT chief lost his job have put the use of volunteer grid computing efforts in the spotlight. The school district alleges that running the program on computers around the clock for nearly 10 years has cost it more than $1 million in energy and other costs, and interfered with teaching by messing up other programs, such as SMART board systems. According to the Arizona Republic and other news reports, Brad Niesluchowski lost his job earlier this fall as network systems administrator at Arizona's Higley Unified School District following an investigation into suspicious activity that included running the SETI@home distributed computing program across 5,000-plus school computers.

In fact, Niesluchowski (or "NEZ") had gained a reputation as a sort of god among SETI@home users for his status as its most active user as documented via a public credit system.  The situation has generated strong opinions from many corners, with some upset by comments by school superintendent Denise Birdwell ("We support educational research and we would have supported cancer research but we however as an educational institutional do not support the search of ET.") that are seen as flip and showing a lack of understanding of how SETI@home really works. Others pointed out that Niesluchowski losing his job stemmed from much more than just his use of SETI@home. A Fox News report  out of Las Vegas includes an interview with Niesluchowski's wife, who says use of the software was authorized by a previous administration. On top of all this, a police investigation is ongoing and involves allegations of possible stolen computers and gear, according to the Republic. 12 cool ways to donate your PC's spare processing power One issue the Niesluchowski affair immediately brought to my mind has to do with the proper use of volunteer computing programs, which allow end users to donate the spare processing power on their computers via one of the dozens of ongoing volunteer computing projects, many based on open source software called BOINC  In compiling a package of stories on volunteer computing this past summer, I asked David Anderson, a research scientist at UC Berkeley Space Sciences Laboratory who founded the BOINC project in 2002, about guidelines for using such software. His response: "I don't think S@h gets a black eye. His response: "The BOINC project's advice is to get permission from whoever owns the machine." I circled back with Anderson today in light of the Niesluchowski situation, asking about whether it might harm SETI@home.

Our policies explicitly forbid this." He said it looks like "NEZ" got obsessed with SETI@home credit and made "some major errors in judgment." On the plus side, Anderson said that SETI@home being in the news reminds the world that the project – which celebrated its 10th anniversary this year - is still going. Follow Bob Brown on twitter. For more on network research news, follow our Alpha Doggs blog.

Report highlights Smart Grid security vulnerabilities

A cybersecurity coordination task force released a report this week that assesses various security and privacy requirements for the U.S. Smart Grid , as well as strategies needed to address them. The draft report highlights the need for planners to address threats that could potentially allow attackers to penetrate the smart grid, gain access to control software, and alter load conditions to cause widespread disruptions. The 256-page document was compiled by the task force, comprised of individuals from the government, industry, academia and regulatory bodies, and led by the National Institutes of Standards and Technology (NIST). Now open for comment, NIST will release a final version of the document in March 2010 describing a overall Smart Grid security architecture and security requirements.

Cybersecurity strategies for protecting the smart grid need to address not only deliberate attacks but also inadvertent compromises resulting from user errors, equipment failures and buggy software, the report said. A smart grid uses digital technology to transmit, distribute and deliver power to consumer in a more reliable and efficient manner than traditional electricity systems. Released as part of the report was a Privacy Impact Analysis that examines some of the privacy implications of establishing a smart grid for power distribution. A key component of the smart grid is the real-time, two-way communication it establishes between consumers and power distributors for tracking energy use and enabling smarter consumption and pricing. While proponents of a smart grid have touted its potential to improve the electricity system, others have expressed concern about their susceptibility to cyber attacks and inadvertent compromises.

Current plans call for nearly 17 million two-way connected smart meters to be installed in U.S. homes over the next few years. Many are concerned that the software, wireless sensor networks and the Advanced Metering Infrastructure (AMI) networks that go into a smart grid present too many points of vulnerability into the network. IOActive researchers showed how attackers could spread malware through the network and remotely shut down power to consumers by taking advantage of flaws in the metering devices. In June, security consultancy IOActive Inc. disclosed how its researchers had tested Smart Grid components for security vulnerabilities and had discovered several that could allow attackers to access the network and cut off power. The NIST report is an attempt to assess such threats . The vulnerabilities that are listed in the report were gathered from existing research and security documents including NIST's own guide to industrial control systems security and the Open Web Application Security Project (OWASP) vulnerabilities list. The report also considers vulnerabilities arising from inadequate patch, configuration and change management processes, weak access controls, and lack of risk assessment, audit, management and incident response plans.

It looks at vulnerabilities that can arise during the operation a smart grid as well as on problems such as authenticating and authorizing users to substations, key management for meters, and intrusion detection for power equipment. Vulnerabilities associated with bad software coding practices, including input validation errors and user authentication errors, can also pose a risk to the integrity of a smart grid, the report said. One major issue that needs to be addressed is the data that will be collected automatically from smart meters. The real-time, two-way communication between consumers and suppliers in a smart grid also raises several privacy concerns, the NIST report noted. There needs to be more of an understanding of how that data will be distributed and utilized throughout the smart grid system, the report said. "In the current operation of the electric grid, data taken from meters consists of basic data usage readings required to create bills," the report said. "Under a smart grid implementation, meters can and will collect other types of data," some of which could be personally identifiable information that needs to be protected with strong privacy controls it said.

Apple patent filing reignites tablet device rumors

A just-published Apple patent application for hand-writing recognition on pen-based computers has re-ignited speculation the company will soon unveil a tablet device. Technically, the Apple patent application - filed in July but published this week by the U.S. Trademark & Patent Office - is for "acquiring and organizing ink information in pen-aware computer systems." That's a type of device that Apple doesn't currently offer, though hand-writing recognition, dubbed Rosetta, was part of the Newton handheld device and operating system, released in 1993. And, according to Wikipedia, some of that code, renamed Inkwell, was introduced into Mac OS X, for use by peripherals graphics tablets. But if that's Apple's plan, the company may be in a furious race with Microsoft, which is leaking and hinting at details of an innovative small tablet device, Courier, now in development. One of the developers of Inkwell, Larry Yaeger, is named in the newest patent application along with Richard Fabrick II, and Giulia Pagallo.

The Apple filing describes a tablet "input device" that "may be a thin layer of sensing circuitry present either beneath the visible screen/tablet surface…or as part of a thin, clear membrane (not shown) overlying the screen…that is sensitive to the position of the pen on its surface. The worst Apple products of all time One of the first sites to pick up on the filing was Seth Weintraub's daily Apple news site, 9to5Mac.com.  Earlier this month, Craig Mundie, chief research and strategy officer, declined to comment on the Courier device but made it clear that Microsoft not only hasn't given up on tablets, but thinks the pieces are in place for a breakthrough product. "Today, several factors are coming together that will probably make the concept more resurgent or at least become more mainstream," he said. "It's a confluence of small, light devices with the hybrid touch and writing screen technology that will finally probably result in a tablet-type computer going mainstream." One key question is what operating system Courier might be using: a slimmed down version of the recently released Windows 7, or an early version of Windows Mobile 7, expected next year, with dramatically improved touch support on Windows handhelds. But the Inkwell heritage raises the question of just what kind of "tablet" Apple may have in mind. Engadget's Tom Ricker uses the pen-oriented patent filing to mock Apple CEO Steve Jobs, who famously called the finger the "best pointing device in the world" compared to the stylus, which has been a staple for Windows Mobile devices for years. Most of the speculation for much of this past year has been around a portable device with a notebook-sized screen and, in keeping with the success of the iPhone and iPod touch, a multi-touch user interface. But Apple's patent filing specifically mentions that "A suitable tablet…for use with the present invention includes the Wacom graphics tablets from Wacom Technology Company of Vancouver, Wash." Wacom's products are advanced USB peripherals that plug into a Mac or Windows computers to enable pen or gesture input.

The Intuoas4, introduced in March, can capture subtle differences in pressure, for example. The Bamboo products are pads only, using the host computer's screen; the Intuoas and Cintiq products incorporate their own displays as well. Tablets have been about to "happen" for the last 20 years. Yet today, tablets are relegated to small niches and vertical applications, such as healthcare. Microsoft has tried at least twice, most recently in 2001, to promote them as the next big thing in personal computing, investing time and treasure in creating intuitive digital ink technology, to make using the screen as easy as using a piece of real paper. But the success of the big-screened, Web-browser-equipped iPhone, and the explosion of the netbook, or shrunken notebook, market seems to be reviving interest in finding the Next Big Small Form Factor device.

The video, which seems more like an animation than a recorded live demonstration, shows a device that opens flat like a small book, with each "page" being a screen, each roughly 5x7 inches. Gizmodo in September released a Microsoft-created video that apparently shows a new, small tablet-like device from Microsoft, the Courier. The interface combines a pen and gestures to take notes and work with a variety of what seem to be PIM and Web applications. "[T]he biggest question that popped up for me is whether the pen interface (digital ink) is the right choice for the job," writes Network World blogger, Mitchell Ashley. "Is the pen interface something that belongs in the Tablet PC era, but not in new touch interface devices?... I personally would rather type, even with a simulated digital keyboard, than write with a pen stylus" Maybe the touch keyboard, like [that] used with the iPhone, is the way to go.

Elpida signs on another Taiwan DRAM maker

Elpida signed another Taiwanese DRAM maker, Winbond Electronics, to a manufacturing and technology partnership on Wednesday, putting an end to rumors that the company might join a rival alliance that uses technology from U.S.-based Micron Technology. Elpida will provide Winbond with advanced DRAM manufacturing and product technology as part of the deal. "The outsourcing agreement is the first step of a business partnership the companies intend to pursue further," the statement says. Winbond will begin producing GDDR3 (graphics double data rate, third generation) and GDDR5 for Elpida by the end of this year, the companies said in a joint statement. Elpida has moved fast to shore up support for its technology in Taiwan, where over-building among DRAM makers led to a glut in DRAM chips and inability to repay loans early this year.

Consolidation efforts have caused companies on the island to rally around two main foreign technology providers, Elpida and Micron. The Taiwan government stepped in to help companies delay loan repayments and worked to encourage consolidation among DRAM makers on the island. The agreement with Winbond puts four Taiwanese DRAM manufacturers in Elpida's camp, versus two for Micron. Elpida and Powerchip also operate a joint venture DRAM manufacturer in Taiwan, Rexchip Electronics. Winbond joins ProMOS Technologies, which inked an outsourcing deal with Elpida last week, and Powerchip Semiconductor, a long time Elpida partner.

Micron has signed up Nanya Technology, and together they operate joint venture Inotera Memories. Winbond began seeking a new technology partner early this year when Germany's Qimonda, which previously worked with Winbond, filed for bankruptcy.

Sidekick's lessons: Why backup for mobile phones is crucial

After the Sidekick near-disaster, mobile phone users might be wondering if they should ever trust any cloud services to protect their vital data. The obvious lessons: 1. Back up your mobile phone's critical data independently - on a laptop, a desktop or a thumb drive. 2. Raise questions about cloud computing and related services. 3. Find out how your mobile device stores data, and make sure you understand it. 4. When in doubt, refer to number 1. Forrester Research analyst James Staten said the Sidekick incident should serve as a reminder to users to back up critical data. "You can't rely on these [cloud] services to be 100% available all the time," he said in an interview. "This is not the first time something like this has happened and it won't be the last time." Not only is a backup of critical data imperative, users need to have a way to retrieve the backed-up data. "You need to think about the value of your data and what happens if the service is not available," he said. On the face of it, there are some obvious lessons to be learned from the Sidekick snafu, even as Microsoft Corp. reported today that most of the data that was missing will be recovered from servers at its Danger Inc. subsidiary. There are many Internet-based services that can be a second backup version to the original backup, such as Plaxo, he said.

At larger companies, data backups are commonplace and often include information contained on wireless phones as well as desktop computers, analysts said. Having the second one drastically reduces the odds of total loss. The issue becomes more difficult when IT shops trust users who put critical company data on personally-owned wireless phones that aren't backed up. Nearly every major smartphone provider is working on some version of cloud computing to back up data from smartphones and other cell phones. Despite urging users to back up critical data, Staten joined three other analysts in remaining faithful to the mobile phone industry's strong push for cloud computing services, noting that the Sidekick case was relatively isolated. All those services could be vulnerable to data loss, and the Sidekick example is likely to prompt a broad re-examination of internal server backup procedures, Staten said. "I'd say that any lesson that says not to trust cloud computing is too aggressive," said Kevin Burden, an analyst at ABI Research Inc.

It's a risk you run." As a result of the industry trend toward cloud computing, and in particular, Google Inc.'s determination to offer many services that way, Burden warned users against overreacting in light of Sidekick's and Danger's relatively isolated problems. "I don't think anyone should react and say, store all the data on your phone or PC," he said. "Doing that would push the mobile industry backward, and the industry is not prepared to go backward. Wireless phones generally come with limited internal storage and some have removeable storage cards, but "they do rely more on backend services and servers in the cloud to provide information." Burden noted that Nokia's Ovi, Research In Motion's BlackBerry Internet Service (for small business users), Motorola's MotoBlur and others are all backend services that "open you up to having data potentially lost, stolen or replicated somewhere that you don't have any knowledge of. We all want our data to be accessible wherever we are, and that's the motivation for cloud computing. No." Ramon Llamas, an IDC analyst, agreed. "I don't think this problem is a warning to anybody to not trust cloud computing. Do you think this incident scares Google?

The cloud is mobile's direction. The cloud is not just a nice thing to have; it's a basic expectation." Llamas said more services are emerging to offer mobile backup, including Best Buy's recent offer to store data for free, called mIQ . Both Llamas and Burden also said the Sidekick snafu should provide a lesson to mobile phone users to be aware of how their phones work and how their data is stored. Smartphones are very much about data, data, data, and everybody is going to want a record of what they do. To that point, they noted that the Sidekick has never been advertised as a phone for business users. "It's not up to snuff as compared to a BlackBerry or iPhone," Llamas said. It doesn't have a third-party application development platform and doesn't offer a high-level operating system or a fast process to handle FIPS (Federal Information Processing Standard) certification, which supports stringent security requirements, the way smartphones typically do, he said. "The Sidekick was never targeted to the business professional, and is really for the hip-hop generation and youth," Burden noted. "Security and secure storage was never its selling point." Danger originally owned the device, calling it the Hip Top, until the device was sold through T-Mobile-USA and the name became the Sidekick.

In fact, Burden said he doesn't consider the Sidekick a true smartphone, mainly because it derived as a single purpose device for voice calls about seven years ago into a voice device with texting added on. Subsequently, Microsoft bought Danger in 2008. "This recent incident exposes some of the deficiencies of the Hip Top/Sidekick," Burden said. "Certain things are not shored up because of the types of users they were going for." While it originally became a texting device atop a good voice phone, it has added other functions but not some of the security basics, Burden said. And after them, everybody else will wonder, 'Could that happen to me?,'" Llamas said. "Imagine if this happened across an entire carrier's servers. Still, Llamas said the problems with the Sidekick will resonate for a while and should give mobile phone users pause about securing their data. "The incident will make people owning a Sidekick question using a Sidekick, and then those who are thinking of getting one. For Verizon Wireless that could be 90 million people. Everybody should think twice if these services could really save your data up in the cloud," Llamas said.

iPhone GPS app market heating up

The iPhone GPS app market unleashed by the release of the iPhone 3.0 software update is getting more interesting by the day, with several developers in an arms race to add new features to their initial offerings. My own in-car navigation box doesn't even speak street names (other than numbered freeways), and it sure makes a big difference. Taking the lead in the GPS app race is Navigon MobileNavigator, which recently added support for spoken street names-a major failing in the three apps that I previewed in a Macworld Video last month.

Last week, I got to spend a little bit of time with Navigon's Johan-Till Broer, who showed me the next version of MobileNavigator, due as a free App Store update sometime in October. The traffic update also does a better job of estimating the speeds of various roads without live traffic data. It adds live traffic to the party, downloading traffic updates over the digital cell network and rerouting you around slow spots. The end result should be that MobileNavigator will do a better job of suggesting the fastest route you should take to your destination, based on both current conditions and the time of day you're traveling. I've found Sygic Mobile Maps to be a solid app, although it feels more like a port of a standalone GPS device than a native iPhone app. Sygic, maker of the Sygic Mobile Maps GPS navigation app, recently updated its app to support spoken street names, as well as catching up with the other apps by integrating the addresses of the contacts in your iPhone's address book.

However, you can't beat the price-Sygic is trying to drive sales of its updated app by reducing the price (temporarily, at least) to $40 for an app containing only United States maps and $60 for the app containing maps of all of North America. TomTom's promised car kit for the iPhone, which promises a mount, speaker, and improved GPS reception, has yet to arrive here in the States. (Our friends at Macworld UK are reporting that the car kit is available for order on that side of the Atlantic, with shipping times listed as "two to three weeks.") As for the TomTom app, the company promises "several updates by the end of 2009," but hasn't given details. While Navigon and Sygic are not familiar names to most Americans, TomTom is a strong brand and its iPhone app has sparked a lot of interest, although the iTunes charts would suggest that it may have fallen behind Navigon in terms of sales. Presumably spoken street names and live traffic are high on the agenda. Look for a comprehensive comparison of iPhone GPS apps from Macworld in the near future.

Reviewing these apps is hard, requiring a lot of driving (and a dedicated driver so the reviewer doesn't cause an accident!), and the features of the apps keep updating at a rapid pace. In the meantime, check out my video above if you'd like to see the apps in action. From my perspective, right now Navigon MobileNavigator is the best choice available, but this game is far from over.

Company hosting Joe Wilson fundraising site recovers from DDoS attack

A company providing online payment-processing services for U.S. Rep. The attack on Piryx began Friday afternoon and lasted into the early hours of Saturday morning and temporarily disrupted a Wilson fundraising effort that was underway at that time. Joe Wilson (R-S.C) is back online after being disrupted by a distributed denial-of service attack over the weekend.

Piryx CEO Tom Serres said. Piryx is a nonpartisan Austin, Texas, based start-up that provides services to help political candidates and nonprofits manage online campaigns and fundraising. It also knocked out services for about 150 other Piryx clients, Serres said. Serres said the company was contacted by Wilson's office last week and asked to manage online donations from supporters rallying behind the congressman after he shouted "You lie!" during President Obama's address to Congress on health care reform Wednesday. Such attacks are designed to render servers and networks inaccessible by flooding them with useless traffic.

Hours after the company began hosting Wilson's homepage on its servers, Piryx found itself the target of a distributed denial of service attack, Serres said. The attacks appear to have been directed at the joewilsonforcongress.com site, Serres said. Initially, the traffic generated by the DDoS attack was manageable but soon Piryx began noticing "massive bandwidth spikes" that knocked its servers offline, Serres said. At the time the attacks started, the site was handling about 100 transactions per minute and had already collected more than $100,000 from people who wanted to contribute to Wilson's campaign, he said. The data center hosting Piryx's servers confirmed that it was the victim of a DDoS attack.

After several failed attempts at mitigating the attacks, filters to block the traffic went into place early Saturday morning. At its peak, the DDoS flood generated about 1 gigabit of traffic per second, which is about 1,000 times the normal traffic on Piryx, Serres said. Service has been normal since then, he said. The incident appears to be one of the rare instances of a politically motivated attack against a Web site in the U.S. said Kirsten Dennesen, an intelligence analyst with Verisign Inc.'s iDefense Labs. It's not known from where the attacks originated, but Serres said it appears to have been initiated by those opposed to Wilson's comments, he said. "It was clearly politically motivated to take down Wilson's ability to raise funds online," Serres said. The attention attracted by Wilson's comments, especially through social media tools such as Facebook and Twitter, appears to have contributed to the attack, she said. "One question is whether there are going to be any response attacks," she said.

Open source security project could get a boost with Metasploit buy

Rapid7 is buying Metasploit, and promising to advance open source penetration testing and the Metasploit Project, which develops exploits against known vulnerabilities. Rapid7 says the deal will provide it with better data about exploits so its customers can discover and fix vulnerabilities that could lead to successful attacks against their networks, the company says. Hottest tech M&A deals of 2009 The upside for Rapid7, a commercial security testing company, is that it will use Metasploit resources to expand capabilities of its NeXpose vulnerability management software. The parties are not saying how much Rapid7 paid for Metasploit.

He will also be Rapid7's chief security officer. "Rapid7 has committed to keeping the project open source, with no plans to change the license or the community development model," Moore says in his blog. "What will be changing is how fast we add new exploits, integrate new features, and release new versions."  With the new resources from Rapid7, the project will make great leaps forward within a few months, he predicts. "They may not be exploit developers, but they understand business and how to make a marriage with Metasploit increase their own bottom line without destroying the value of project in the process," he says. Meanwhile, the all-volunteer Metasploit Project will gain a full-time development staff led by its originator H.D. Moore, who becomes chief architect for the project supported by an exploit developer, a user-interface designer and a quality assurance engineer, according to his blog. These advances will include expanding Metasploit's exploit library and increasing the number of publicly available exploits, Rapid7 says.

Indian telecom department officials face charges

India's Central Bureau of Investigation (CBI) said Thursday that it is pursuing criminal charges against some officials of the country's Department of Telecommunications (DOT), private sector companies and some individuals, in connection with alleged irregularities related to the award of telecommunications licenses by the DOT. The CBI did not name the individuals or companies that it plans to charge under the country's Prevention of Corruption Act. The award of licenses for mobile 2G telephony and related services was criticized by the local telecom regulator, Telecom Regulatory Authority of India (TRAI), which recommended competitive bidding. The CBI conducted searches Thursday to collect incriminating documents in the Wireless Planning Cell (WPC) and in the office of Deputy Director General for Access Services of the DOT, it said in a statement. The DOT instead decided that licenses would be allocated on a "first-come-first-serve" basis at low prices that were current in 2001, CBI said.

DOT went along with the recommendation but in October 2007 it stopped accepting applications, citing a surge in demand for the licenses. TRAI had also recommended in 2007 that there should not be a ceiling on the number of service providers in a service area. In a letter to TRAI in July this year, DOT asked the regulator to review its decision that there shouldn't be a cap on the number of service providers in a service area. India awarded 281 telecom licenses as of June 30 this year, but there is still a waiting list of 343 applicants for 22 service areas in the country, according to the letter from the DOT. This backlog exists despite the DOT stopping acceptance of license applications in October 2007. The CBI said that by putting a cap on the number of licenses, there had been a criminal conspiracy between certain officials of the DOT and some private companies and individuals to award licenses to select companies. DOT said that the requirement of creating competition in the market had been met, and that it would find it difficult to allocate spectrum to all the applicants.

There is worry in government and industry circles that investors may be bidding for telecom licenses to make a quick buck by subsequently selling stakes in their telecom companies at huge valuations to large Indian and foreign service providers, said informed sources. In the case of 3G licenses, the government has taken the view that licenses and spectrum should be auctioned. Among the companies waiting for a license are some construction companies that have found mobile telecom services a new diversification opportunity. This auction has been postponed since January.

10 Tried-and-True Tips for Switching Industries

With the economic recession wreaking havoc on the financial services, automotive, retail and other industries, many IT professionals in those markets who've been laid off are considering an industry switch to open up their job searches. They say diversifying one's job search will increase their odds of landing a new job more quickly. Indeed, many career experts are urging job seekers to apply for jobs in the few industries that are growing or are poised for growth despite the recession, such as green energy and technology, education, and healthcare.

But switching industries can be an uphill battle for IT job seekers. Hiring any executive is a high-risk and costly endeavor, so employers want to make sure that whomever they hire is right, can hit the ground running, and doesn't need to come up to speed. Companies often don't want to hire executives outside of their industries because it increases their risk. Consequently, that often means that employers seek candidates with experience specific to their industry. (Of course, there are times when a company specifically seeks an industry outsider to bring in a fresh perspective.) Despite the challenges associated with switching industries, doing so is not impossible. Recently, I moved from healthcare to educational publishing.

I have worked in multiple vertical markets, including broadcasting, retail, manufacturing and education. I found this particular transition very challenging, but from this-and other-experiences, I learned several valuable lessons about moving from one industry to another. Consulting or unpaid internships are options to consider if you have the opportunity and the means. I hope my lessons will help you move into a new industry and make your transition a seamless one. 1. Immerse Yourself If you're hunting for a job in a new vertical market, consider spending a week or two in the new environment. As an experienced IT leader, your expertise is extremely valuable to many organizations.

That large-scale project management expertise sets you apart. Have you overseen an ERP conversion? For every vertical market, there is a company struggling with a problem you've already solved. I had experience that a company in those markets found beneficial, and a conversation with the head of each organization led to those opportunities. This is how I got into publishing, health care and education. Start by reaching out to your existing professional network.

Through those conversations, I got the chance to guest-lecture for one of my professional colleagues as an IT industry expert. When I engineered my transition to higher education, I sought out colleagues who taught at colleges and universities, and I talked to them about their experiences and challenges. I thoroughly enjoyed the experience, and it led to further introductions to other professors, more discussions about higher ed's needs, and gave me the opportunity to explain how my work in publishing applied to their needs. Using Twitter and LinkedIn, I connected with educators all over the country and learned what troubles were universal. If you can't find connections in your professional network, social networking tools like LinkedIn and Twitter are great places to find professionals working in the vertical market you wish to enter.

With those insights, I developed a pitch that expressed how my experience could help them. They introduced me to their peers, and a new professional network was born. Specifically, I explained how my experience with open source tools, web publishing and marketing was valuable to admissions professionals in higher education and how I helped colleagues build tools to measure and improve the effectiveness of their social media campaigns. About two weeks into my social media campaign, I started to get recognized as an industry expert, even though I had never worked in the industry. With the economy being what it is, your target market is likely experiencing a major shortage of training and development dollars.

I simply joined the conversation, contributed where I could, and respected those who were already there. Figure out what you can offer folks in that target market and get out there. 2. Practice Nemawashi Nemawashi is a Japanese term that literally translates to "going around the roots." The concept of nemawashi is so engrained in the Japanese culture that it is difficult to translate into English, but it is most often translated as 'laying the groundwork.' As it was explained to me, nemawashi is an informal process of quietly laying the foundation for a change by talking to the people concerned, gathering their support and feedback before any formal steps are taken, and maintaining the harmony and credibility of those involved. This is a critical practice for gathering information about your new industry and identifying ways to help prospective employers in it. It's similar to our concept of getting buy-in, but the primary difference is that nemawashi is done quietly-almost covertly-before the idea for the desired future state is formed. I wish I had practiced nemawashi during the early stages of my current career transition.

The amount of paperwork he had to do to open an IRA account was staggering. I was spending a lot of time with Jeremy, the branch manager at my local bank, to get my personal finances in order. I helped Jeremy a few times with some simple Windows shortcuts as he was trying to copy and paste information from one form to another. It was enough for Jeremy and I to retire on. I did a little math in my head and realized that for this bank, the 20 minutes of work Jeremy was doing, multiplied by the number of IRA accounts they open (which Jeremy estimated for me) worked out to be a very large dollar figure.

I shared my calculation with Steve, a colleague who was doing some programming work for Jeremy's bank. Steve liked my ideas, but said it wasn't quite practical for the bank for security reasons. I also shared my ideas on how to trim some costs from the process. Had I practiced nemawashi with Jeremy and Steve, I could have learned about the security risk before suggesting the possible change, and perhaps I could have worked with Steve to refine and revise the idea so it more closely matched the needs of the bank. Nemawashi can help you gain support in the rookie stages, win allies, and most importantly, influence an organization in the right direction. 3. Establish Your Credibility I met Chris Brogan and Julien Smith during my days in publishing, when they were working on a book, Trust Agents, about using the web and social media to build influence, reputation and trust.

Whether you have five or 50 years of experience under your belt, in a new industry, you are the rookie. One of the core premises of their book is that to have credibility in a social network, you must be "one of us." For example, if a soft drink company is trying to sell a new cola to an online community of gamers, the company can't just join the conversation with, "Hey guys, check this out." Only if an existing, valued member of the group says, "Check this out," will the recommendation have any merit. I don't know how many times I had ideas shot down because I didn't have experience in the industry, simply because "that's not how it's done." It didn't matter that I was hired to improve things; I had no credibility with the audience and met resistance at every step. Brogan and Smith's notion of "one of us" applies to switching industries. When I moved into education and health care, though, things were different. Staff management is probably the area where this is most true.

I was a trusted member of the group from the get-go because I had practiced nemawashi without even realizing it. 4. Don't Assume Your Experience Transfers Not all of your leadership experience is going to apply from one industry to another. The industry you're in will impact the types of people your company will attract and retain, and this will shape the culture of your department more than any other factor, even when the fields seem similar. Certain aspects of budgeting can also vary from industry to industry. For example, I found that certain management techniques, such as mentoring and motivating employees with challenging projects, worked well in an advertising agency, but were completely ineffective in publishing, where a much heavier management style was necessary. One of the most common mistakes I've seen-and made myself-is miscategorizing information assets and liabilities on balance sheets and improperly valuing the assets stored on a company's IT infrastructure. This made asset categorization very clear and easy.

I learned quickly that in healthcare, an information asset has a fixed shelf life that's normally mandated by a governing body. This was also the case in broadcasting. The morale of this story? But it was not the case in publishing, as I once learned the hard way, after spending a pretty penny to store assets that had little value to the company. Understand the business as well as you can before you categorize your company's assets. 5. Don't Assume Your Experience Doesn't Transfer Some disciplines are stable enough that the differences between vertical markets are barely discernible.

A basic rule of thumb is that if an IT function is frequently outsourced, your experience in that area will be transferable. 6. Learn the Industry's Concept of Customer If you take only one thing from this list, make this it: Who is the customer for your organization or industry? Telephony, application delivery, helpdesk service, and project management easily transfer from one industry to another. In healthcare, our customer varied from conversation to conversation: It's the patient, the insurance company, the government, the referring physician, the patient's employer, and the patient's family. The reason it's so important to know the customer is because the customer truly is your boss. We all understood that it was the patient who chose our practice, and all the other customers were also working for the patient.

They can fire you (and your organization) simply by taking their business elsewhere. What's more, your understanding of the customer guides every decision you make. I've found that the most successful companies are the most customer-centric. Knowing who your organization is ultimately accountable to-and demonstrating this from the earliest point possible-will ensure that your transition is successful. I also recommend you ask prospective employers during your job interviews with them who their customer is.

I recommending asking yourself, "Who is my customer," every day. If their answer ever varies, take this as a huge warning sign. While I was consulting for a media company, the IT staff I was working with pulled me aside to tell me about one person in particular who was troublesome. If the organization can not agree on the central concept of customer, it will have an identity crisis about who it serves and will always struggle to provide exceptional customer service to its ultimate customer base. 7. Identify and Win the Troublemakers Once you're in your new job in a new industry, you have a short amount of time to identify the influential troublemakers and make them your ally. They advised me to avoid that person at all costs.

I wanted to know why the IT staff felt the way they did, and if there was any merit to their feelings. Instead, I sought her out immediately. I didn't ask her those questions specifically, but I asked her what she felt the IT organization was doing right and wrong. By having an open and honest conversation with her, I made a very powerful strategic ally, and in the process, I identified a number of solutions to some of the key issues the IT department was facing. We talked for two hours. We went on to make some great progress together, and those accomplishments were critical in helping me understand the industry, the company, and most importantly, to quickly identify where big progress could be made in a short amount of time.

There is a delicate ecosystem of cash flow, and it can be disrupted at many different places. That was several years ago, and this person's name is still on my reference list. 8. Learn the Industry's Revenue Streams Who actually pays for your product or service? Do you clearly understand the industry's revenue stream? Luckily, I was young when I made it, and I have tried to avoid it ever since. The biggest mistake of my career came in this area. My first "real" job out of college was in radio broadcasting.

It was my job, I thought, to entertain the listeners and keep them tuned in to the station as long as possible. I went to work for a large FM radio station. According to the ratings, I was pretty good at it. There was a partial power failure in the area, and about one-third of the building was without power. One evening when I came in for my shift, I found the afternoon air personality sitting in a dark control room.

The transmitter was on, but we weren't able to put anything on the air or to control the transmitter. I knew the station's cash flow relied on our ability to play commercials to our audience, so I proceeded to reschedule every commercial that was missed during the previous hours. Using extension cords, power strips and wirenuts, I managed to put us back on the air nearly five hours before the power was restored. I thought my program director would be ecstatic; I had saved several thousand dollars of revenue. I had gotten the station back on the air and reestablished our link to the audience, but the audience had turned to other stations when we fell silent a few hours before my shift began. As it turned out, I was only half right.

Commercials that should have aired to a few hundred thousand people aired only to a few thousand. In the end, I was credited with saving a large portion of the revenue and making the best out of a bad situation, but I only understood a small portion of the equation that made up our revenue stream. It took nearly a week for our ratings to return to their normal levels. I never forgot that lesson. Is it directly by the customer, or is it like the health care system where the customer has multiple agents (many with different goals and objectives) serving them and their needs, and therefore funding your cash flow? How is your industry's revenue stream supported?

A clear understanding of that cash flow process well help you identify where your IT team can best contribute. 9. Acceptable Risk Always Varies You've probably had a directive from a CEO after a server malfunction that sounded like this: "We simply can not afford any more down time. The conversation immediately following sticker shock is where you and your CEO decide what is the acceptable risk-level for the organization. Fix the problem!" So you proposed a clustered server, a disaster recovery site, or some other topology proven to increase reliability and uptime, and presented it to the CEO. That's when sticker shock sets in. Basically, it's the amount of risk the enterprise is willing to tolerate in exchange for the cost to mitigate that risk. Healthcare, for example, has a low risk tolerance for data loss: It can't afford to lose historic patient data. And you can not assume that the level of risk an organization in one industry tolerates will be the same for an organization in another industry.

But comparatively, publishing has a higher risk tolerance for data loss. 10. Keep an Open Mind Just as individual organizations are at different stages in their IT systems maturity, some industries are categorically ahead or behind the curve. Keep an open mind as you move from one industry to another. As technical folk, we find it difficult to imagine that magnetic tape is still used as a primary storage medium; however, many broadcasters are just now moving to hard disk and optical-based storage media from tape drives. J. Marc Hopkins is a Cincinnati, Ohio-based veteran of small business technology leadership in a variety of industries, including higher education, healthcare and media. He currently teaches at DeVry University and can be reached through his blog on CIO.com, LinkedIn and Twitter. He specializes in infrastructure design and consolidation, staff development, business intelligence, and business process improvement for non-profit and mission-focused businesses.

2009 Women of Influence Award Winners Named

The 2009 Executive Women's Forum "Women of Influence" Awards were awarded recently at the event in Scottsdale, Arizona. The winners nominated by peers in the security community. The awards were co-presented by Alta Associates and CSO Magazine, recognizing women in four categories: one winner from the public sector or academia, a private solutions provider from the security industry, a corporate practitioner from the private sector, and finally, 'One to Watch,' a future leader in the security field.

This year, the public sector winner is Mischel Kwon, the director of the U.S. Department of Homeland Security's Computer Emergency Readiness Team (US-CERT). Kwon, an IT professional with more than 26 years of experience, was named to her current position in June 2008. As the director for the US-CERT, Kwon is responsible for the operational mission of the US-CERT, including the analysis and reduction of cyber threats and vulnerabilities in federal networks, dissemination of cyber threat warning information, and coordination of incident response activities. The 2009 private solutions provider winner is Patricia Titus, chief information security officer with Unisys Corporation. Kwon previously served with the United States Department of Justice, where she was deputy director for IT security staff. Prior to her position with Unisys, Titus served for six years with the Transportation Security Administration, where she created, implemented and maintained a robust IT Security program and led her team to have an IT Security Program rated with a FISMA compliance score of "A" for 18 months. This year, the winner in the WOI corporate category is Michelle Dennedy, chief governance officer for Sun Microsystems.

When she joined Unisys Federal Systems as the Chief Information Security Officer, she brought much of that rigor to its security program, according to her nomination. Dennedy is seen as a creative leader in changing the view of privacy from that of strict regulation to one of social responsibility, according to her nomination. The 2009 'One to Watch' winner is Char Sutter, SVP Information Security with HSBC North America. In addition to raising the visibility of data privacy and data integrity issues to all of Sun's engineering and field employees, Dennedy has been a staunch advocate of processes to incorporate that awareness into best practices, ranging from laptop encryption to evaluation of privacy standards in acquired companies. According to Sutter's nomination, while she is a relatively newcomer to the information security field, she has embraced it with a passion and made a tremendous difference at HSBC. Sutter has made significant contributions to an HSBC Identity and Access Management program that was launched two years ago.

App Store success could change software-buying habits

More than 2 billion applications have been downloaded from Apple Inc.'s App Store, with more than 85,000 apps available to 50 million-plus iPhone and iPod Touch owners worldwide. After the App Store launched on July 11, 2008, it took nine months to hit 1 billion, and only six more months to hit 2 billion, noted Carl Howe, an analyst at Yankee Group Inc. "The more devices that are out there, the more people want to download software, and they see it's an easy and fun experience," Howe said in an interview. The numbers announced by Apple today are staggering to even normally reserved analysts, who noted that after a somewhat slower summer buying rate, App Store downloads globally have exceeded more than 10 million a day in much of September. It also helps that Apple has attracted 125,000 developers to its iPhone Developer Program, he noted.

With the success of the App Store and the growth in other application storefronts backed by BlackBerry, Android and others, "any digital media is fair game," Howe said. After the one-year mark was reached in July, analysts were heralding application stores, including several imitators of the App Store, as the new way to buy software. "You don't have to go to a store to a buy a disc and get the ultimate in instant gratification," Howe said. In fact, while games are a big hit on the App Store, both the free and the paid versions, Apple is calling attention to its "staff picks," which include a free app for the complete works of Shakespeare, with a text-sizing tool. Howe said one of the secrets of the App Store's success is the large number of devices downloading them, but another is the ease with which the apps are downloaded. "If you provide a friction-free way of buying things like App Store, which shortens the time it takes from an impulse to buy to actually buying something, you'll sell a lot," Howe said. "There's not a lot of time for buyer's remorse, and it's a lot like going past a magazine stand in a store and paying $3 for a magazine. In a 28.8 MB app, users get all 40 plays, 154 sonnets and six poems, as well as some works attributed to the Bard, although whether he wrote them remains in doubt.

There's not a lot of remorse in buying that item." A Yankee survey of 1,200 U.S. smartphone owners showed that 18% of applications are paid for. Even the recession has not held back this kind of impulse buying. "The recession doesn't seem to be having an impact. However with growth in the average cost of the paid apps, and the growth in the number of devices, the U.S. revenues from applications will grow by 10 times between 2009 and 2013, reaching $4.2 billion in 2013 . In that survey, more than 70% of all the apps downloaded in the U.S. were games. "It's interesting that you see how the App Store is doing when it was not that long ago - about 2001 when the dotcom bubble burst- that people were saying people would want information to be free on the Internet," Howe noted. These small impulse purchases are kind of recession-proof," Howe said. Enderle said the application store concept might have come along earlier had bricks-and-mortar retailers not objected. "The fact is, that with enough bandwidth, there's very little that can't be delivered over the Web," Enderle said. "We're witnessing what will probably be the end of the traditional software delivery model.

Rob Enderle, an analyst at the Enderle Group, said the two billion mark is "outstanding" given the number of phones available for downloads. App Store is an indicator that the times they are a changin'."

Oracle profits rise but sales fall in Q1

Oracle's first-quarter net income rose by 4 percent year-over-year to US$1.1 billion, but revenue fell by 5 percent to $5.1 billion, the company said Wednesday. New software license sales fell 17 percent year-over-year to $1 billion, indicating that customers are still reluctant to make new software investments amid the ongoing recession. Earnings per share were $0.22. Excluding one-time charges, Oracle reported earnings per share of $0.30, partly meeting the expectations of analysts polled by Thomson Reuters, who had on average predicted earnings of $0.30 per share and $5.25 billion in revenue.

Oracle managed to increase profits even as revenue fell by "substantially improving" its operating margins, company President Safra Catz said in a statement. Associated expenses were just $226 million, meaning the profit margin for this part of Oracle's business was greater than 90 percent. Oracle's results were also bolstered by growth in revenue for software license updates and support, which jumped 6 percent to $3.1 billion. Oracle blamed the dip in new license sales partly on weak business at other software vendors. "They sold less of their applications, and so they drive less database with them," Catz said in a conference call. Oracle announced plans to acquire Sun earlier this year, but the acquisition is being held up by an antitrust review by European authorities.

The earnings report comes a day after Oracle announced a new Exadata data warehousing and OLTP (online transaction processing) appliance jointly developed with Sun Microsystems. Oracle executives offered no new details about the deal Wednesday, but said integration planning work is proceeding. The company is well-positioned to compete against IBM with its recently updated database and middleware products, he said. During the call, CEO Larry Ellison repeatedly targeted IBM, who Oracle will soon be battling in both software and hardware markets. Oracle shares were down $0.78 in after-hours trading to $21.35.

Bank sues Google for ID of Gmail user

A bank that inadvertently sent confidential account information on 1,325 of its customers to the wrong Gmail address is suing Google for the identity of the Gmail account holder. According to court documents, the bank in August received a request from one of its customers asking for certain loan statements to be sent to a third-party. The case, filed in the U.S. District Court for the Northern District of California, involves Rocky Mountain Bank of Wyoming.

An employee of the bank, responding to the request, sent the documents to the wrong Gmail address. When it discovered the error, the bank immediately sent an e-mail to the Gmail address asking the recipient to delete the previous email and the attachment. In addition to the requested loan information, the bank employee also inadvertently attached a file containing names, addresses, tax identification numbers and other details on 1,325 account holders to the same address. The bank also asked the recipient to contact the bank to discuss what actions had been taken to comply with the bank's request. When Google refused to provide any information on the account without a formal subpoena or court order, the bank filed a complaint asking the court to force Google to identify the account holder. When it received no reply, the bank sent an e-mail to Google asking whether the Gmail account was active or dormant and also what it could do to prevent unauthorized disclosure of the inadvertently leaked information.

Rocky Mountain Bank also requested that its complaint and all of the pleadings and filings in the case be sealed. U.S. District Court Judge Ronald Whyte dismissed that request, saying there was no need for the proceedings to be sealed. "An attempt by a bank to shield information about an unauthorized disclosure of confidential customer information until it can determine whether or not that information has been further disclosed and/or misused does not constitute a compelling reason," Whyte wrote last week. The bank said it hopd to prevent unnecessary panic among its customers and a "surge of inquiry from its customers." The bank argued that if the complaint and motion papers are not sealed, all of its customers would learn of the inadvertent disclosure. This is the third time in recent weeks that Google has faced a similar issue. The man alleged that the contributors to the paper had unfairly linked him to government corruption. Earlier this month, the Associated Press reported that a resort developer in Miami had obtained a court order requiring Google to disclose the identities of anonymous contributors to an online newspaper in the Turks and Caicos Islands.

In that case, Google indicated that it would disclose the data only after first informing the paper about the request and giving it a chance to appeal for the court order to be quashed. In the other incident, a court in New York compelled Google to disclose the identity of a blogger who had made disparaging comments about a Vogue model in her blog "Skanks in NYC."

Windows Bug Enables PC Hijacking, Microsoft Warns

Microsoft Corp. last week confirmed that a bug in Windows Vista, Windows Server 2008, and the release candidates of Windows 7 and Windows Server 2008 R2 could be used to hijack PCs. The vulnerability in the Server Message Block (SMB) 2 network file- and print-sharing protocol that ships with those versions of the Windows operating system was first disclosed late last Monday, when a researcher posted exploit code. Microsoft recommended that users either disable SMB 2 by editing the Windows Registry - a task too daunting for most consumers - or block TCP Ports 139 and 445 at the firewall until a patch is available. The next day, Microsoft issued a security advisory confirming the bug and the fact that it could be used to "take complete control of an affected system." Microsoft did note that the release to manufacturing, or RTM, editions of Windows 7 and Windows Server 2008 R2 are not affected, along with earlier versions of the operating system, including Windows 2000, XP and Server 2003. However, the vulnerable release candidates have been widely distributed, with millions of users downloading Windows 7 RC when it was publicly available from early May through mid-August. However, the company acknowledged that blocking those ports would cripple several services and applications.

As expected, a patch for the recently revealed vulnerability in its Internet Information Services Web server wasn't ready in time for the monthly update. The Windows bug was disclosed the same day Microsoft delivered five critical updates that patched eight vulnerabilities in Windows, including one in the JavaScript engine that ships with every supported version of the operating system. This version of the story originally appeared in Computerworld 's print edition.

HP to focus on services with new print division

Hewlett-Packard on Monday formed a new print services division with a focus on managing print and imaging hardware and software in enterprises. The unit will also provide services and software that put scanned or printed documents in workflow systems to make document management easier. The division, called Managed Enterprise Solutions, aims to unify disparate hardware such as copiers, printers and scanners in order to cut hardware and printing costs, said Vyomesh Joshi, executive vice president of HP's imaging and printing group. The company's attention has been geared toward hardware and supplies, but software and services surrounding printing and imaging are a growing opportunity, Joshi said.

There is more to printing than just hitting the print button, said Roger Douglas, director of managed print services at HP. For example, software provided with the managed services could enable an invoice to be scanned, which can automatically be put into a company's payroll system. The company sees a US$121 billion annual opportunity in the printing market, of which $64 billion is for hardware and $57 billion for software and services. The automation reduces the number of steps and cost required to manage the document, Douglas said. The documents can also be secured through a service by establishing a status to ensure documents aren't appended, Douglas said. It also reduces the chance for error through manual transcription.

For example, if a marketing logo is finalized on a particular document, its status can be appended to ensure no one changes it. The company is also changing printer designs to build in more services-related functionality. This approach is particularly helpful when editing legal documents, he said. For example, a touch screen on multifunction printers can be used to input or check the job status of scanned documents like patient records. "A lot of times customers have treated imaging and printing like an afterthought," Douglas said. The company has also expanded the availability of a program that guarantees savings for customers who sign up for its print services outside the U.S. Under the plan, HP assesses a company's imaging and printing environment and calculates the possible savings a company can realize using HP's managed services.

Managed print is all about stepping back and taking a more strategic and methodical look at how those documents are managed, he said. If customers haven't realized the savings in a year, HP will make up the difference with a credit that can be used for their next printing services contract. The unit will be a part of the company's imaging and printing division, Joshi said. The company has already signed up 100 customers since it launched that program, Joshi said. The company has pulled some personnel from the existing services division and has seen its services customer base expand since acquiring EDS. HP has a strong presence in the printer market, and the expansion of services could help the company capture a larger share in the printer space, said Edward Crowley, CEO of Photizo Group, who was at HP's press briefing Monday.

The increased level of focus on services could also benefit HP's enterprise customers, he said.

Researchers slam fickle iPhone anti-fraud feature

The iPhone's new defense - meant to prevent users from reaching phishing sites - is inconsistent at best, a security researcher said today, with some users getting warnings about dangerous links, while others are allowed to blithely surf to criminal URLs. Other experts said that the fickle feature is worse than no defense at all. But according to Michael Sutton, the vice president of security research at Sunnyvale, Calif.-based Zscaler, the new protection is "clearly having issues." At first, said Sutton, the anti-phishing feature was simply not working. "It was blocking nothing," Sutton claimed after testing iPhone 3.1's new tool Wednesday against a list of known fraudulent sites. Apple quietly added an anti-fraud feature to the iPhone's Safari browser with the update to iPhone 3.1 , released Wednesday.

By Thursday, things had improved, but just barely. "Yesterday, it started blocking some sites, for some users, but it was inconsistent. Apple relies on Google 's SafeBrowsing API (application programming interface) for the underlying data used to build anti-phishing and anti-malware blocking lists for the desktop edition of its Safari browser. Some sites are being blocked, others are not." That led Sutton to believe that the feature's functionality wasn't the issue, but how Apple updates users with a "blacklist" of malicious sites. Other browser makers, including Google and Mozilla, also use SafeBrowsing. "It appears some iPhones are getting timely updates [from Apple], but others are not, or are getting different [block list] feeds," Sutton said. "I'm feeling better about the feature than I was Wednesday, but clearly Apple is still have issues. URLs that are blocked by Safari in Mac OS X open and direct users to malicious pages [on the iPhone]." Like Sutton, James reported inconsistencies in the anti-fraud feature's effectiveness. "All we've come up with is that sometimes it works and sometimes it doesn't," said James. "This is clearly more dangerous than no protection at all, because if users think they are protected, they are less careful about which links they click." The new feature is turned on by default in iPhone 3.1; the option to turn it off is in Settings/Safari/Security, and is listed as "Fraud Warning." Sutton, although willing to concede that Apple overall is improving its security track record, bemoaned the state of mobile security in general, and the iPhone's in particular. "The greater concern to me is that we're making the same mistakes in mobile that we made on the desktop," he said. "On the desktop, security has gotten slowly better, but [with mobile] we have a fresh start. With the [media] coverage of the problem, maybe they're resolving it, or trying to." On Thursday, researchers at Intego, a Mac-only antivirus vendor, echoed Sutton's findings. "This feature should warn users that they may be visiting a known malicious Web site and ask if they wish to continue," said Peter James, a spokesman for Intego who writes the company's Mac security blog . "However, we have extensively tested this feature, tossing dozens of phishing URLs at it, and it simply does not seem to work.

I would have thought we would have learned from our mistakes, but there's virtually no protection in mobile browsers." According to research conducted by NSS Labs, which was hired by Microsoft to benchmark different desktop browsers' ability to block malware-laden sites, Safari in Mac OS X and Windows blocked only one-in-five malicious sites . Internet Explorer and Firefox, meanwhile, blocked 80% and 27%, respectively. Last month, NSS Labs attributed the disparities between Firefox, Safari and Google - all which use SafeBrowsing as the basis for their blacklists, to differences in how each browser tweaked, then applied, the lists. Google's Chrome blocked a paltry 7% of the sites.

Undersea Internet cables undergoing repairs after typhoon

Some undersea fiber-optic cables that carry Internet and communications traffic to parts of Southeast Asia and China have already been repaired while officials continue to assess damage to others, a spokesperson for Chunghwa Telecom said Friday.

Six of the important fiber-optic cables were damaged by undersea landslides caused by Typhoon Morakot as it passed Taiwan. One was knocked out on Aug. 9 as Morakot hit the east coast of the island and the others were damaged after the typhoon passed to the other side.

The damaged cables disrupted Internet and telecommunications between Taiwan, China, Hong Kong and parts of Southeast Asia, including Singapore and the Philippines. However, Chunghwa Telecom of Taiwan restored service quickly by using backup systems and rerouting traffic to other cables.

The APCN2 (Asia Pacific Cable Network, number two) was damaged in at least two places, said Chen Hui-yen, a deputy director at Chunghwa's network management division. One part, which runs between Singapore and Malaysia, was fixed Friday morning, she said, while a portion of the cable near Taiwan has not been repaired yet, although a team has been dispatched to the location.

She did not know the cause of the problem with the cable section between Singapore and Malaysia. She said some voice traffic and Internet traffic has been affected by the outages but rerouting has alleviated most problems.

The five other undersea cables damaged near Taiwan by Morakot were the SWM-3 (Southeast Asia - Middle East - Western Europe 3), the APCN (Asia Pacific Cable Network), C2C Cable Network East Asia Crossing (EAC), C2C Cable Network (C2C) and FLAG (Fiber Optic Link Around The Globe) North Asia Loop (FNAL).

One factor complicating repairs of the undersea cables has been trying to coordinate the various groups invested in the cables, she said. She was unable to offer a time frame for when cable repairs might be completed.

Undersea fiber optic cables carry the bulk of the world's Internet and communications traffic. Natural disasters such as earthquakes and deep sea landslides can disrupt the cables.

Typhoon Morakot was originally welcomed by people in Taiwan as a potential savior for a drought that had been affecting much of the tropical island. Some cities, including the old southern capital of Tainan and the norther port city of Keelung, had already imposed water restrictions. But Morakot brought far more rain than expected, causing massive floods and landslides on the island.

The presidential office said the rains from Morakot were the heaviest in 50 years.

Typhoon Morakot has been blamed for the deaths of 116 people in Taiwan, according to government figures, and officials expect the toll to continue rising. Rescue workers believe over 300 people in one village, Hsiaolin, may have been buried alive in a massive landslide of mud and debris.

Rescue workers saved 2,200 people stranded by landslides and washed out roads and bridges in mountain villages near the southern city of Kaohsiung on Thursday. Thousands remain stranded in disaster areas and rescue work continues.

Taiwan's Council of Agriculture estimates the typhoon destroyed NT$10.67 billion (US$324.3 million) of crops and other goods, including tens of thousands of livestock such as pigs, chickens and ducks.

How to Learn Anything on the Web

A tutorial or class for almost everything and anything is available online these days. Whether you're looking to beef up your résumé with some new skills, to get a degree while waiting for the job market to pick up, or simply to have a little fun learning something new, the Web has a wealth of educational resources-many of them free of charge.

To give you some ideas, we've put together a list of sites in several categories, from skills for budding entrepreneurs and learning foreign languages to gourmet cooking and the choreography for Michael Jackson's iconic Thriller dance.

You can always Google for anything you don't see here, but be careful as you click. In researching this story, I ran into many sites that either tried to sell me classes (with little or no real free instruction) or were infested with pop-ups and adware. Antimalware software is a must. (See PC World's free downloads of antimalware programs.)

Get a Business Up and Running

So you have a business in mind? Start with a business plan that outlines the specifics of how you intend to make money-essential for attracting investors and useful for your own reality checks. BPlans.com, run by PaloAlto Software (creators of Business Plan Pro software) offers dozens of articles, sample plans, and templates to help you get going. This is one of the few sites that, while it does market a product (you need its software to edit a sample plan and use it for your own enterprise), delivers a slew of genuinely useful content for free. (And you can always simply recreate the sample plan using Word and Excel.)

Once you've launched your business, you'll have to keep financial records. But even if you use software such as Quickbooks, it's a good idea to understand how basic accounting works. Small business consultant Dave Marshall's Bean Counter site features free tutorials on basic business accounting and bookkeeping.

And because so many aspects of business require presentation skills, it's useful to have a working knowledge of Microsoft's PowerPoint. About.com's Presentation Software site provides a Beginner's Guide to PowerPoint that gathers 11 tutorials to get you going.

Your business will need a Web site too. You can pay someone a lot of money to create it, but if you would like to dig into the complexities of modern Web design, LearnWebDesignOnline.com is a good place to start, with links to tutorials, videos, and books on all aspects of site creation. Another resource is SiteGround, a Web hosting company that provides an impressive tutorials page for learning about both Web hosting in general and a wide array of specific applications for content management and site creation (WordPress, Dreamweaver, and the like).

If you're interested in putting together a news site, J-Learning.org provides guidance on everything from blogging tools and multimedia creation to SEO and legal issues-all for free.

To help bring visitors to your site, you'll need to learn the basics of search engine optimization (SEO). Search consultants SEOmoz's free Beginners Guide is a good place to start.

Improve Your Tech Skills

Okay, time out for a little self-promotion. For general hardware upgrades, setup instruction, and software tips, look no further than PC World's own How-To page. Organized by category, there's an amazing wealth of guidance (in print, video, and slide shows) for everything from swapping out a PC's processor to getting Microsoft Office to work better.

However, for professional in-depth training in specific applications, Lynda.com has established itself as the go-to place, with thousands of videos and tutorial files for hundreds of applications. It's not free, but if you're serious about learning a complicated application, its subscription-based fees are a good value. (Read PC World's recent review of Lynda.com.)

Have you ever wanted to explore the mysteries of computer programming? You can find a slew of programming tutorials online, but I like British programmer Alan Gauld's Learning to Program, an online version of a book he's written. It's not particularly slick, but he writes clearly and accessibly, and he uses Python, which experts tell me is a good programming language to start with.

Next: Formal Education, Languages, and Life Skills

Formal Education

The Internet has turned distance learning into a reality: Today, you can get all sorts of degrees and professional certificates through online courses. But not all online learning institutions are created equal. To avoid scams, start your search for Web-based higher education at The Sloan Consortium's Sloan-C Catalog. It's a list of degree and certificate programs offered by regionally accredited institutions who have become Consortium members (either because they've received grant support from the respected Alfred P. Sloan Foundation or through a peer-review process). You can search by discipline, type of degree or certificate, state, or institution name.

If you or someone you know wants to earn a GED (General Educational Development) credential (the equivalent of a high-school diploma), learn about the process from the organization that administers the GDE program, The American Council on Education. You can't take the test online, but dozens of sites offer to prep you-and many of them look pretty sleazy, so I'd stick with the ACE's links to practice tests and educational resources.

If you don't care about getting a degree and simply want to broaden your horizons, head over to YouTube EDU, a very cool YouTube subsite devoted to videos of interviews, courses, and lectures from professors at top colleges and universities. Some are mostly course promos (such as Carnegie Mellon physics professor Barry Luokkala's description of his Science and Science Fiction course) but some have real content (such as this MIT course on creating compilers).

Learn a Foreign Language

It's easy to find sites that sell foreign-language instruction online. But here are some neat ones that don't charge for instruction and also offer audio clips:

Chinese (Mandarin): Chinese-Tools.com, the English-language version of a site run by a native French speaker who has lived in China for six years, is a fantastic resource. It not only has audio clips (crucial since Chinese depends on tone and inflection as well as simple pronunciation), but also calligraphy instruction.

French: About.com's French Language site provides lessons for beginners as well as interesting extras including sections on idiomatic expressions and typical Gallic gestures.

Italian: Oggi e Domani (which means "today and tomorrow" in Italian) focuses on conversations in its lesson-based approach.

Russian: I found a couple of sites that seem to be duking it out for supremacy in free online Russian-language instruction: Russian Lessons.net and Learning Russian.net. Of the two, Learning Russian.net looks slicker, but Russian Lessons.net appears to have more resources.

Spanish: 123TeachMe offers Spanish lessons for beginners, advanced students, and tourists (conversational Spanish).

Life Skills

Some things you just can't learn in traditional classrooms. Real Simple has tons of how-tos for around-the house skills-I like the Daily Quick-Cleaning Checklist, which promises to get your pad presentable in under half an hour. For the truly domestically challenged, WikiHow has a page on how to make your bed.

EmilyPost.com, the Web home of the Emily Post Institute, does get a little heavy-handed on selling books by the late doyenne of good manners and her descendants, but there are lots of free articles that provide advice on specific etiquette dilemmas.

And if you're looking to make dinner with whatever's in your refrigerator, simply enter the ingredients into the search fields of FoodNetwork.com, Epicurious or RecipeSource (formerly SOAR, or the Searchable Online Archive of Recipes). For really great how-to's (not to mention recipes and juried product and equipment ratings), consider investing $35 a year (less if you subscribe in print, too) in the online version of Cook's Illustrated, the ad-free Consumer Reports of cooking.

Need help with your finances? Motley Fool is one of the oldest and best sites to learn about investing and personal finance (and their discussion boards are great, too). If you're looking ahead to retirement, the Labor Department's Consumer Information on Retirement page answers a lot of questions on private pensions, 401ks, and the like.

Next: Sports and Games, Performing Arts

Have Some Fun

Learn to play a game: ChessDryad.com's How to Play Chess page will get you from learning the mechanics of the game to classic moves, with primers and flash animations. Veteran bridge author Richard Pavlicek has put his Bridge Basics textbook online for people wishing to learn the popular card game. For neophyte poker players, Charles Bloom has put up a Texas Hold'em primer.

For sports (or anything else highly physical and visual), you can't beat YouTube: For example, I found dozens of skateboarding how-tos, but the one I actually felt I could learn from was this unpolished but accessible effort credited to one "Eswolowski" and posted by a user named tevens22.

However, not all sports stuff is on YouTube. Aspiring soccer moms and pops should check out How to Play Soccer, which not only teaches the rules of the game, but offers tips for parents who serve as coaches or spectators.

Showbiz Stuff

Aspiring musicians, dancers and filmmakers can also find instruction online. SoYouWanna.com offers a guide for making low-budget movies.

Like to sing along in perfect harmony? ChoralWiki maintains a database of free choral sheet music. If your garage band needs help figuring out the guitar solo in Dire Straits' "Sultans of Swing," head to 911tabs, a very nifty search engine for tablatures (musical annotations showing fingerings for specific pop and rock songs). You can search by song and by instrument.