Grassley seeks proof of jobs from H-1B applicants

WASHINGTON - One of the U.S. Senate's leading critics of the H-1B visa program, Sen. Grassley wants IT consulting companies that hire H-1B workers at third party client sites to prove that there is work waiting for them. Charles Grassley (R-Iowa), is asking immigration officials to toughen their demands for evidence from companies hiring visa workers.

The timing of his request to the U.S. Citizen and Immigration Service (USCIS) is no accident or is Grassley's interest. In a statement accompanying the release of his letter to Mayorkas, Grassley said, that "Employers need to be held accountable so that foreign workers are not flooding the market, depressing wages, and taking jobs from qualified Americans. About a year ago, Grassley released a USCIS study that found either evidence of fraud or other violations in one-out-five H-1B visa petitions . His letter to USCIS Director Alejandro Mayorkas, released Tuesday, also comes just prior to the start of the new fiscal year, Oct. 1 and the release of 66,700 H-1B visas petitions, a number well short of the cap, applied for since April 1, the start of the annual petition process. Asking the right questions and requesting the necessary documents will go a long way in getting out the fraud in the H-1B program." Five months after USCIS completed its fraud study, federal officials arrested about a dozen people and charged with fraud. The U.S. recently expanded the case ; the company is fighting the charges in federal court.

One of the cases involved a New Jersey company, Visions System Group Inc. alleged to have set up shell offices in Grassley's home state. Grassley said in his letter that the USCIS should be asking, "companies up front for evidence that H-1B visa holders actually have a job awaiting them in the U.S.," and not end up being "benched," or unpaid until work is found. In response, a USCIS official said Mayorkas has received the letter and will respond for it. Grassley is also seeking information on the progress the USCIS has made on a number of other issues addressed in the fraud report, including job duties that differ from those described in the petition and failure to pay prevailing wages. Grassley's letter to tougher steps comes at the same time that some immigration attorneys have complained of stepped up enforcement efforts this year, especially with request for more evidence to support a petition. Richard Durbin (D-Ill), have introduced legislation that would toughen the rules on H-1B program, and impose a number of restrictions , especially on Indian firms and their ability to use large numbers of visa holders without hiring a proportional number of U.S. workers.

Grassley, along with U.S. Sen. The U.S. can issue up to 85,000 H-1B petitions under the cap, with 20,000 set aside for advance degree graduates of U.S. universities. IT employment is down generally, and with it, demand for the visa.

Nortel users should hope for best, prepare for worst

Users should chart the progress of Avaya's purchase of Nortel's enterprise assets carefully, so that they are spared any unpleasant product integration or rationalization surprises. Avaya last week also won court approval for the purchase. Product overlap, consolidation and subsequent support are the biggest issues facing Nortel enterprise customers on the heels of Avaya's $900 million purchase of that business.  Avaya last week emerged as the winning bidder for Nortel's enterprise business, beating out Siemens Enterprise Communications for the asset.

The rise and fall of Nortel Now comes the uneasy task of sifting through the product portfolio and eliminating redundancies - an ordeal that could leave Nortel - and even Avaya users - with a shortened lifespan on their investments. "Like an onion, there are lots of layers," says Nortel customer Bruce Meyer, director of network services at ProMedica Health Systems in Toledo, Ohio. "Let's see where they go from here." "There may be some surprises there," says Bob Hafner, an analyst with Gartner. "These are going to be two large companies coming together. These things never go without issues, problems or concerns." Significant overlap is expected in the IP telephony/unified communications portfolios of both companies - such as IP PBXs, handsets and call management software. It's not the easiest thing to do. Avaya is the leading revenue market-share vendor in enterprise telephony, according to Dell'Oro Group, while Nortel is No. 4. Little to no overlap will be found in routers, switches and other infrastructure products, where Nortel has a significant market share and installed base. We need a reliable infrastructure." "The biggest issue for users is, 'Show me the [product] road map,'" says Henry Dewing of Forrester Research. "They want to see hardcore product plans and how they are going to actually consolidate product lines." Avaya has pledged near term support for the Nortel enterprise products, including those serviced by Verizon, a Nortel reseller. Indeed, Meyer believes Nortel routers and switches will be less susceptible to discontinuation than the VoIP products, because Avaya has virtually no data products. "With Avaya, there's not a lot of strength in enterprise data," Meyer says. "[Avaya] will want to know that the infrastructure is good.

Verizon filed motions last week seeking assurances that Avaya would continue to support the Verizon accounts, which the carrier says include many federal law enforcement agencies.   "I'd be surprised if that issue doesn't work itself out," says IDC analyst Abner Germanow of the Verizon/Avaya scuttle. "I'd have a hard time believing they'd leave the U.S. government out to dry." Longtime users such as Meyer and Promedica would also like support assurances. To that end, Avaya kicked in $15 million for employee retention, on top of the $900 million purchase price for Nortel Enterprise Solutions. In addition to product direction, Meyer hopes the relationship his company has had with Nortel sales, service and support representatives remains intact. Nortel enterprise chief Joel Hackney said last week that Avaya could retain as much as 75% of Nortel's enterprise staff, though he would not say how many the unit employed. We're talking about lots of long-term relationships.

Published reports, however, stated that Avaya may only retain 60% or less of the Nortel enterprise workforce, a situation that troubles Meyer. "My concern is reduced staff," he says. "What are those reductions going to mean? Brand loyalty comes from post-sales support. IDC's Germanow is advising Nortel customers to accelerate any assessment or planning activities in light of the Avaya takeover. "They should figure out where their own needs lie and how to most effectively migrate," he says. "They should hold companies to their multi-vendor visions - that open means open." Meyer, for now, is holding fast and not contemplating any alternative vendor options in light of Avaya's takeover of Nortel's enterprise business. "This is still a wait-and-see scenario," he says. "How much of this will be a replay of Bay/Nortel?" he asks, referring to Nortel's 1998 acquisition of Bay Networks, which largely crippled the No. 2 player to Cisco in routers and switches. "This is going to be really interesting to watch." If those relationships change because of staffing changes, that would be a big deal." Gartner's Hafner agrees. "Customers need to pay attention to what's going on in the [merged] organization" to detect any potential distractions or turf battles or downsizings that may adversely affect them, he says.

Hacker leaks thousands of Hotmail passwords, says site

More than 10,000 usernames and passwords for Windows Live Hotmail accounts were leaked online late last week, according to a report by Neowin.net , which claimed that they were posted by an anonymous user on pastebin.com last Thursday. Neowin reported that it had seen part of the list. "Neowin has seen part of the list posted and can confirm the accounts are genuine and most appear to be based in Europe," said the site. "The list details over 10,000 accounts starting from A through to B, suggesting there could be additional lists." Hotmail usernames and passwords are often used for more than logging into Microsoft 's online e-mail service, however. The post has since been taken down.

Many people log onto a wide range of Microsoft's online properties - including the trial version of the company's Web-based Office applications , the Connect beta test site and the Skydrive online storage service - with their Hotmail passwords. Accounts with domains of @hotmail.com, @msn.com and @live.com were included in the list. It was unknown how the usernames and passwords were obtained, but Neowin speculated that they were the result of either a hack of Hotmail or a massive phishing attack that had tricked users into divulging their log-on information. Microsoft representatives in the U.S. were not immediately able to confirm Neowin's account, or answer questions, including how the usernames and passwords were acquired. Last year, a Tennessee college student was accused of breaking into former Alaska governor Sarah Palin's Yahoo Mail account in the run-up to the U.S. presidential election.

The BBC , however, reported early Monday that Microsoft U.K. is aware of the report that account information had been available on the Web, and said it's "actively investigating the situation and will take appropriate steps as rapidly as possible." If Neowin's account is accurate, the Hotmail hack or phishing attack would be one of the largest suffered by a Web-based e-mail service. Palin, the Republican vice presidential nominee at the time, lost control of her personal account when someone identified only as "rubico" reset her password after guessing answers to several security questions. Kernell's case is ongoing. David Kernell was charged with a single count of accessing a computer without authorization by a federal grand jury last October. Shortly after the Palin account hijack, Computerworld confirmed that the automated password-reset mechanisms used by Hotmail, Yahoo Mail and Google 's Gmail could be abused by anyone who knew an account's username and could answer a single security question.

Unisys service uses the cloud to manage mobile devices

Unisys is introducing a new service on Wednesday that will allow its customers to better manage, secure and support mobile devices carried around by employees, company executives said on Tuesday. CIOs are concerned about corporate data "roaming the streets," he added. Staff now expect to use their choice of devices anytime and anywhere, and this causes problems for CIOs around cost, the cost of support, and the security of applications and data, said Tony Doye, president of Unisys' Global Outsourcing and Infrastructure Services group, in a telephone interview.

The service framework for the new end-user productivity services will support Windows Mobile phones and BlackBerry devices, with support for the iPhone and other devices available in later releases. Some early-adopter customers, mainly in Central Europe, are already using the mobile-device management framework, he said. Currently organizations generally manage devices with specific technologies that only work with a specific platform, rather than with a consistent framework across a variety of devices, said Sam Gross, Unisys' vice president for global IT outsourcing solutions. The framework is managed by Unisys for customers, and the management and support of the devices is also done from the company's services delivery centers around the world, he added. Unisys is also offering access to standard office suites by subscription through a service called Virtual Office as a service from the Unisys Secure Cloud.

The new service will enable CIOs to reduce end-user costs by providing support for different devices, desktop PCs, applications and mobile data access through a mix of traditional, virtualized and secure cloud-based service delivery models, Unisys said. The Unisys Secure Cloud has technology that protects both data in mobile devices and in storage, using a combination of encryption and dispersion of data. "The model that we are delivering is server-side virtualization services, and in this situation the data never ends up on the end-point," Gross said. Unisys' Unified Communications as a Service, also delivered through Unisys Secure Cloud, offers Microsoft Exchange, Microsoft Office SharePoint Server and Microsoft Office Communicator applications in a multi-tenant environment. Unisys is also offering generic services such as the ability to destroy the image on a device if it is reported lost, he added. Besides offering these productivity applications, customers can also provide their employees with access to other applications running at the company, through the Unisys cloud, Gross said.

Indian ban on spurious mobile phones found inadequate

The Indian government has asked mobile service providers not to allow calls on their networks from mobile phones without proper International Mobile Equipment Identity (IMEI) numbers from Dec. 1, citing security reasons. The IMEI number is used by GSM (Global System for Mobile Communications) networks to identify mobile devices. The order, however, has a glaring loophole as it does not provide for the blocking of calls from phones that use "clone" IMEIs, said Pankaj Mohindroo, national president of the Indian Cellular Association (ICA), a trade body that represents mobile handset makers and other mobile technology vendors. It is used by operators to block a stolen phone from using the network.

The Sept. 3 order from India's Ministry of Communications & IT only refers to phones that have no IMEI numbers or have a sequence of 0s in place of the IMEI number, or "non-genuine" numbers that are not, in fact, IMEI numbers. Clone IMEIs are those that have been issued to registered handset vendors but have been copied on to phones of dubious origins, Mohindroo said. ICA has told the government that handsets that have clone IMEI numbers should also be banned in the interest of security, Mohindroo said. A large number of mobile phones that are sold in India are either spurious or unbranded, often sold at low prices without bills or warranty. The use of mobile phones without proper IMEI numbers is seen by the government as a threat to the country's security, as terrorists have been found to use mobile phones extensively. A large number of consumers have bought these phones because of their low prices.

In a letter to service providers in April, the Ministry of Communications & IT recognized that some of the users of phones without proper IMEIs were "genuine innocent subscribers." Using software would be a far more attractive option than to have to throw out the phones, said Sridhar T. Pai, CEO of Tonse Telecom, a firm that researches the telecom market in India. The government approved earlier this year a Genuine IMEI Implant (GII) proposal from service providers that programs genuine IMEI on mobile handsets. Pai added that he had not evaluated the software yet. Operators have delayed implementing the ban because customers are their key assets and they will not do anything that will upset these customers, Pai said. Banning of the use of phones without adequate IMEI numbers has been delayed because of lack of clarity from the government and also because of a slow response from service providers that had earlier been ordered to block calls from phones without proper IMEIs from July 1, according to analysts.

The Cellular Operators Association of India, an association of GSM mobile operators, was not available for comment, but an official said in private that its members would be able to meet the Dec. 1 deadline. Phones with fake IMEI numbers are to be detected by reference to the IMEI database of the GSM Association (GSMA). The database of the GSMA will be able to detect fake IMEIs, but will not detect phones that have clone IMEIs, unless there is also a device management program that reveals the specification of the device, Mohindroo said. The Sept. 3 government order has expanded the ban to include mobile phones that have fake IMEIs, besides phones that have no IMEIs or a string of zeros in place of the IMEI. It has ordered service providers to make provisions in their Equipment Identity Register (EIR) so that calls from phones from all three types of defaulting phones are rejected from Dec. 1 by the networks. The EIR will then have to check whether the IMEI matches with the original device to which the number was issued, he added.

China's Alibaba expects India joint venture this year

Top Chinese e-commerce site Alibaba.com aims to announce an Indian joint venture this year as the company expands its global footprint, it said Friday. A deal in India, where Alibaba.com recently surpassed 1 million registered members, would be the latest in the site's efforts to grow abroad. "I've got a lot of confidence in India," said Jack Ma, CEO of Alibaba Group, the parent company of Alibaba.com. Alibaba.com is in talks with an Indian reseller about forming a joint venture, CEO David Wei told reporters at a briefing.

Alibaba.com is a platform for small and medium businesses to trade everything from lumber and clothes to iPods and PC components. Alibaba.com already works with Indian publishing company Infomedia 18, its likely joint venture partner, to promote its platform in the country. Its main member base is in China, but the site also has 9.5 million registered users in other countries and facilitates many cross-border trades. The site also has a joint venture in Japan and recently launched a major U.S. advertising campaign to attract more users there. Ma said Alibaba knows it needs to "do something" in Latin America as well. Ma and other top Alibaba executives visited the U.S. early this year for meetings with potential partners including Amazon.com, eBay and Google.

When asked if the company would also seek to expand in Eastern Europe, Ma said, "I will be there." Alibaba will not hold a majority stake in joint ventures it forms, instead taking a share similar to the 35 percent it has in its Japan operation. "Our global strategy means partner with local people," Ma said. "We want partners and we want partners to control their business." Users place total orders of more than US$200 million each day on the Alibaba.com international platform, Wei said. About 50 percent of those orders go to Chinese exporters, he said.

Researchers slam fickle iPhone anti-fraud feature

The iPhone's new defense - meant to prevent users from reaching phishing sites - is inconsistent at best, a security researcher said today, with some users getting warnings about dangerous links, while others are allowed to blithely surf to criminal URLs. Other experts said that the fickle feature is worse than no defense at all. But according to Michael Sutton, the vice president of security research at Sunnyvale, Calif.-based Zscaler, the new protection is "clearly having issues." At first, said Sutton, the anti-phishing feature was simply not working. "It was blocking nothing," Sutton claimed after testing iPhone 3.1's new tool Wednesday against a list of known fraudulent sites. Apple quietly added an anti-fraud feature to the iPhone's Safari browser with the update to iPhone 3.1 , released Wednesday.

By Thursday, things had improved, but just barely. "Yesterday, it started blocking some sites, for some users, but it was inconsistent. Apple relies on Google 's SafeBrowsing API (application programming interface) for the underlying data used to build anti-phishing and anti-malware blocking lists for the desktop edition of its Safari browser. Some sites are being blocked, others are not." That led Sutton to believe that the feature's functionality wasn't the issue, but how Apple updates users with a "blacklist" of malicious sites. Other browser makers, including Google and Mozilla, also use SafeBrowsing. "It appears some iPhones are getting timely updates [from Apple], but others are not, or are getting different [block list] feeds," Sutton said. "I'm feeling better about the feature than I was Wednesday, but clearly Apple is still have issues. URLs that are blocked by Safari in Mac OS X open and direct users to malicious pages [on the iPhone]." Like Sutton, James reported inconsistencies in the anti-fraud feature's effectiveness. "All we've come up with is that sometimes it works and sometimes it doesn't," said James. "This is clearly more dangerous than no protection at all, because if users think they are protected, they are less careful about which links they click." The new feature is turned on by default in iPhone 3.1; the option to turn it off is in Settings/Safari/Security, and is listed as "Fraud Warning." Sutton, although willing to concede that Apple overall is improving its security track record, bemoaned the state of mobile security in general, and the iPhone's in particular. "The greater concern to me is that we're making the same mistakes in mobile that we made on the desktop," he said. "On the desktop, security has gotten slowly better, but [with mobile] we have a fresh start. With the [media] coverage of the problem, maybe they're resolving it, or trying to." On Thursday, researchers at Intego, a Mac-only antivirus vendor, echoed Sutton's findings. "This feature should warn users that they may be visiting a known malicious Web site and ask if they wish to continue," said Peter James, a spokesman for Intego who writes the company's Mac security blog . "However, we have extensively tested this feature, tossing dozens of phishing URLs at it, and it simply does not seem to work.

I would have thought we would have learned from our mistakes, but there's virtually no protection in mobile browsers." According to research conducted by NSS Labs, which was hired by Microsoft to benchmark different desktop browsers' ability to block malware-laden sites, Safari in Mac OS X and Windows blocked only one-in-five malicious sites . Internet Explorer and Firefox, meanwhile, blocked 80% and 27%, respectively. Last month, NSS Labs attributed the disparities between Firefox, Safari and Google - all which use SafeBrowsing as the basis for their blacklists, to differences in how each browser tweaked, then applied, the lists. Google's Chrome blocked a paltry 7% of the sites.