Bits Blog: Target Says Data Was Stolen From 40 Million Shoppers

Crime Scene: Chasing Down a GPS Blip to a Stolen iPhone

Devices like hers were stolen 16,000 times last year in New York City. But what happened on this afternoon was anything but commonplace. The closest comparison that leaps to mind is a classic chase scene from a 1971 thriller.

The teenager, soon out of sight, had every reason to believe his getaway was whistle clean. The woman, with just as many reasons to believe that was the last she would see of her phone, flagged a police officer, who put a call over the radio with a description of the young man wearing a yellow hooded sweatshirt. Another officer pulled out his own iPhone, and together with the victim, logged into the Find My iPhone feature, which should work if the thief had not turned the victim’s phone off.

He had not. A telltale dot appeared on the screen of the officer’s phone. The victim’s phone was nearby, at 126th Street and Roosevelt Avenue.

“That’s a block away,” Police Officer Haaris M. Hamid, 28, said. He got behind the wheel of an unmarked car, his sergeant beside him. “I can get there and get the guy,” the officer said.

They arrived at the corner where the phone should have been, under an elevated stop on the No. 7 train. The officer and the sergeant looked around and then ran upstairs. Nothing. A train had just pulled away.

Officer Hamid called his colleague with the Find My iPhone feature and asked him to refresh the search. This time, it came up at 111th Street and Roosevelt.

The thief had to be on the subway.

They ran back downstairs to the car. The chase was on. Officer Hamid, his car siren blaring, wove through traffic and blew through intersections while the sergeant called out on the radio, looking for a means of stopping the train.

They arrived at the 111th Street station, still lagging behind the subway, and lingered long enough to make sure the people exiting the station did not include the suspect. They raced on, to the 103rd Street stop. Same thing: train leaving, no yellow hoodies.

Onward the officer drove, around cars beneath the subway tracks, like Gene Hackman’s character, Detective Popeye Doyle, in “The French Connection.” Of course, Popeye was after a cop-killing henchman for a drug smuggler, while Officer Hamid was chasing a teenager who had stolen a woman’s iPhone. But, as they say, the city has changed.

“I was like, ‘Oh my God, this is crazy,’ ” Officer Hamid, a seven-year police veteran, recalled. “It was seriously like a movie.”

A police captain called the Metropolitan Transportation Authority, and the subway’s conductor was ordered to stop the train short of the next station, at Junction Boulevard. Officer Hamid, his sergeant, and a captain and a lieutenant who had joined the chase ran upstairs.

The conductor opened the door. “I was pretty much at the end of the line,” Officer Hamid said. “You’ve got to let the bosses go first and everything.”

The bosses and officer went car to car, looking at faces. Around the fourth car, Officer Hamid saw a young man whom he recognized from Flushing. He was wearing a blue sweatshirt. But still. “I go, ‘Sarge, that’s him.’ ”

Asked where he was coming from, the young man replied, “Brooklyn.” The No. 7 train makes exactly as many stops in Brooklyn as it does on Uranus.

Other passengers were watching with interest. So were the bosses. Officer Hamid hoped he had the right guy. The victim was on the street below, with other officers. Officer Hamid called down and asked someone to dial the victim’s phone.

“It rang,” Officer Hamid said. “In his back pocket. I was like, ‘Thank God.’ ” Passengers broke out in chatter, and the suspect’s eyes opened wide. “Like, ‘Uh-oh,’ ” Officer Hamid said. The suspect, Jordan Osborne, 19, had a yellow hooded sweatshirt in his backpack. He later told officers, “I took the phone to sell it,” according to a criminal complaint. “I was short on cash.” The police and the suspect left the train, which resumed its journey to Manhattan.

The suspect remains at Rikers Island while the case is pending.

Simple arithmetic suggests there were 42 other phones or electronic devices stolen in New York that day.

E-mail: crimescene@nytimes.com

Twitter: @mwilsonnyt

VUDU Movie Streaming Service User Data Stolen

Vudu, a popular on-demand HD video streaming app that enables users to watch their favorite TVs and movies online as well as on Android tablets, Roku, Xbox 360 and PS3, experienced a break-in at its Santa Clara offices.

In addition to other objects of value, criminals made off with hardrives, which Vudu employees concluded had user data— names, email addresses, phone numbers, addresses, account activity and the last four digits of credit card numbers.

It's important to note that the drives did NOT contain full credit card numbers, as we do not store that information," Vudu CTO Prasanna Ganesan wrote in the email to users.

The break-in affected users who directly use the Vudu site or app only — users who have accessed media via other websites on Vudu are unaffected by the break-in. Ganesan says that all of the passwords on the harddrives were encrypted, but users should still be vigilant "given the circumstances" of the theft.

Vudu has already expired and reset the passwords of compromised users, and has advised everyone to be cautious about suspicious emails or phone calls from Vudu or other companies. In addition, Vudu is offering a year's worth of fraud and identity protection service AllClear ID in case anything does happen, with additional enrollment steps.

Got questions? Vudu has set up a FAQ to answer pertinent questions.

What do you think about Vudu's break-in? Let us know in the comments.

Lauren Hockenson is a tech reporter and 8-bit enthusiast who dreams of being a wizard. She can be found on MyIGN at lhockenson or on Twitter at @lhockenson.

Chinese Businessman Pleads Guilty in Stolen Software Case

The sophisticated software was stolen from an estimated 200 American manufacturers and sold to 325 black market buyers in 61 countries from 2008 to 2011, prosecutors said in court filings. U.S. buyers in 28 states included a NASA engineer and the chief scientist for a defense and law-enforcement contractor, prosecutors said.

Corporate victims in the case included Microsoft, Oracle, Rockwell Automation,, Agilent Technologies, Siemens, Delcam, Altera Corp and SAP, a government spokesman said.

U.S. officials and the Chinese man's lawyer, Mingli Chen, said the case was the first in which a businessman involved in pirating industrial software was lured from China by undercover agents and arrested.

The businessman, Xiang Li, of Chengdu, China, was arrested in June 2011, during an undercover sting by U.S. Department of Homeland Security agents on the Pacific island of Saipan, an American territory near Guam.

Video from the undercover meeting in Saipan, filed as evidence in court, is expected to be made public during a press conference Tuesday by John Morton, director of U.S. Immigration and Customs Enforcement, and Charles M. Oberly III, the U.S. Attorney for Delaware.

Li, 36, originally charged in a 46-count indictment, pleaded guilty late Monday to single counts of conspiracy to commit criminal copyright violations and wire fraud.

"I want to tell the court that what I did was wrong and illegal and I want to say I'm sorry," Li told U.S. District Judge Leonard P. Stark during a 90-minute hearing in federal court. The Chinese citizen spoke through a translator.

In a court filing, prosecutors David Hall and Edward McAndrew said the retail value of the programs Li sold on the black market exceeded $100 million.

During the hearing, Li told U.S. District Judge Leonard Stark that he disputes that figure. After the hearing, his lawyer said Li did not realize the retail value of what he was selling until he was caught and plans to present his own estimate at sentencing, which is set for May 3, he said.

In recent years, U.S. officials have targeted software pirates overseas but bringing them to the United States has proved difficult.

In one of the largest copyright cases, U.S. prosecutors last year charged seven people, including Megaupload founder Kim Dotcom, with racketeering conspiracy and copyright violations. The indictment alleges that Dotcom, who lives in New Zealand, ran an organization that earned $175 million selling an estimated $500 billion worth of pirated movies, TV shows and other entertainment media. Dotcom is fighting extradition from New Zealand.

EXPENSIVE SOFTWARE

The Li case involves sophisticated business software, not entertainment software, and thus small quantities of higher-priced products. The retail value of the products Li pirated ranged from several hundred dollars to more than $1 million apiece. He sold them online for as little as $20 to $1,200, according to government court filings.

At one point, Crack99.com and Li's other sites offered more than 2,000 pirated software titles, prosecutors said.

Li trolled black market Internet forums in search of hacked software, and people with the know-how to crack the passwords needed to run the program. Then he advertised them for sale on his websites. Li transferred the pirated programs to customers by sending compressed files via Gmail, or sent them hyperlinks to download servers, officials said.

"He was pretty proud of himself," Chen said of his client's business acumen. "He did not realize it was such a big crime."

Agents from Immigration and Customs Enforcement/Homeland Security Investigations learned of Li's enterprise after an unidentified U.S. manufacturer noticed his company's software for sale on crack99.com.

Working undercover for 18 months beginning in early 2010, the U.S. agents made at least five purchases from Li. These included pirated versions of "Satellite Tool Kit" by Analytical Graphics Inc. of Exton, Penn., a product prosecutors said is "designed to assist the military, aerospace and intelligence industries through scenario-based modules that simulate real-world situations, such as missile launches, warfare simulations and flight trajectories." Agents bought software worth $150,000 retail for several thousand dollars.

Agents lured Li from China to the U.S. territory of Saipan under the premise of discussing a joint illicit business venture. At an island hotel, Li delivered counterfeit packaging and, prosecutors said, "Twenty gigabytes of proprietary data obtained unlawfully from an American software company." Officials did not identify the company in court documents.

(Editing by Cynthia Osterman)

Japan’s Space Agency Says Rocket Information Was Stolen by Computer Virus

Poorly paid police officers often live cheek by jowl with criminals. When violence erupts, low-level officers are easy targets.

Catching up with one of the founders of Twitter — a new dad who no longer follows anybody on Twitter.

Bits Blog: NASA Says Staff Information Was on Stolen Laptop

NASA told its staff this week that a laptop containing sensitive personal information for a large number of employees and contractors was stolen two weeks ago from a locked vehicle.

Although the laptop was password protected, the information had not been encrypted, which could give skilled hackers full access to the contents.

In its notice to employees on Tuesday, the agency said:

On Oct. 31, 2012, a NASA laptop and official NASA documents issued to a headquarters employee were stolen from the employee’s locked vehicle. The laptop contained records of sensitive personally identifiable information for a large number of NASA employees, contractors and others. Although the laptop was password protected, it did not have whole disk encryption software, which means the information on the laptop could be accessible to unauthorized individuals. We are thoroughly assessing and investigating the incident and taking every possible action to mitigate the risk of harm or inconvenience to affected employees.

This is not the first time NASA has suffered a serious breach. The agency has long been a target for cybercriminals looking to pilfer sensitive research. In 2004, computers at several NASA sites, including its Jet Propulsion Laboratory in Pasadena, Calif., were breached. And as recently as March, the company reported a breach that was also caused by a stolen laptop.

Given its history, it is unclear why the agency has not stepped up its security practices. Beth Dickey, a NASA spokeswoman, said that in this most recent case, the employee’s laptop had been for a security upgrade.

“The laptop was scheduled to receive encryption, as part of an ongoing, agency-wide effort to encrypt whole disks of all NASA computers,” Ms. Dickey said. “This one just hadn’t been done yet.”

NASA has said it plans to have all of its laptops running whole-disk encryption software by Dec. 21.

The message was first posted by SpaceRef, a trade publication focused on space systems.

National Briefing | West: Ipad Stolen From Home of Steve Jobs Is Found in Clown’s Hands

Cheating isn’t just a potential dream-buster in major-league baseball. It can derail teenage Scrabble players, too.

Two environmental organizations discuss carbon credits and fees.

No Passwords Stolen in Minecraft Security Breach

After a Minecraft security breach over the weekend, Mojang reports that no passwords or personal information has been lost. According to Minecraft creator Notch on Twitter, a “flaw in [the] Minecraft authorization system” was exploited by hackers, which let them “log in as anyone” and control other people’s characters.

The servers were taken offline over the weekend as a result, but Mojang developer Leonard Axelsson notes on Twitter that "The session servers are back up again and it's no longer possible to login as someone else." In an updated blog post on the company’s official site, Mojang’s Lisa Winters also reports that “things are back up and running perfectly!” She also confirms that the breach did not result in "any leak of passwords or personal information” and thanks fans for being patient while the servers were fixed.

Minecraft will be updated to version 1.3 next month, rebuilding Minecraft’s single-player framework and adding emerald ore, new stairs and more. Minecraft was most recently released on Xbox 360, where special Summer of Arcade skins are now available.