I’m delighted to announce the TechCrunch Japan TokyoCamp 2009, which will be held on Friday, November 6. TokyoCamp 2009 is co-organized by by DESIGN IT!, LLC. (a Sociomedia group company that runs TechCrunch Japan) and Nikkei Digital Core (a community under the umbrella of the Nikkei, Japan’s biggest business publication).

There’s going to be a demo pit (no less than 21 of Japan’s finest startups will demo their wares) and a meetup/networking party afterward.

Registration is required for both events. Here are the details:

TokyoCamp 2009

Demopit
Date: November 6, 2009
Time: Demopit 5:30pm – 7:30pm
Venue: Nikkei Shimbun 2F SPACE NIO*
Fee: Free

Meetup
Date: November 6, 2009
Time: Meetup 8:00pm – 10:00pm
Venue: Manhattan Bleu (B2 floor of Sankei Kaikan, 2 buildings away from Nikkei HQ / Google Maps)
Fee: 6,000 yen

Use this entry form to register.

Please note that we are extremely restricted on numbers this time, so don’t be disappointed if you can’t get on the guest list (TokyoCamp 2009 is strictly an “invitation-only” event). We hope everyone has a great evening and are looking forward to seeing you all on November 6!

Update:
Registration is closed.

*
SPACE NIO, 2nd floor, The Nikkei Head Office
1-3-7, Otemachi, Chiyoda-ku
Tokyo Metro Otemachi station: Take exit C2ba for The Nikkei Head Office

Don’t confuse this new location with the old Nikkei Head Office at 1-9-5 Otemachi.

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

MindMeister is an online mind mapping tool that allows you to create, share and collaborate on mind maps. The new re-jiged iPhone app has some key differences. Namely it supports sharing mind maps and also supports MindMeister’s “geistesblitz” or “brainwave” feature which allows you to insert those brilliant eureka ideas that you get when you’re in the bathroom into your default mind map on the mindmeister site. Perfect for the iPhone.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

We’ve heard from numerous sources that mobile ad network AdMob may be in the process of acquiring AdWhirl, the startup that lets iPhone developers tap into multiple ad networks. One source has even said that AdWhirl is already working out of AdMob’s offices, though we haven’t confirmed this. Update: this is confirmed

Asked on the phone whether AdWhirl has been acquired by AdMob, AdWhirl CEO Sam Yam responded, “How did you know that,” before clamming up with a “no comment.”

It’s an interesting partnership, and one that raises a few questions. AdWhirl allows developers to switch between different ad networks on the fly without having to submit a new application coded with another ad network to Apple. The service has support for five different ad networks, including AdMob, Quattro Wireless, Videoegg, Jumptap, Mobclix and Millenial Media. Mobclix has a competing iPhone exchange that AdMob is not a part of. But if AdMob and AdWhirl have a relationship, this might make the waters a bit murky for the other networks. It would be suspect to have an open platform that is owned by one of the ad networks.

The acquisition does come as a surprise, however. In June, AdMob announced its decision to cut off ad network aggregators like AdWhirl and Tapjoy, claiming it had been hearing of complaints of technical glitches related to ads served by such “ad net mediators.” The company later announced a delay in this decision in August.

UPDATE: AdMob acquired the assets of AdWhirl, according a press release issues this afternoon.

Crunch Network: MobileCrunch Mobile Gadgets and Applications, Delivered Daily.

I don’t have comparable data to back it up, but anecdotally it seems the Web 2.0 generation is doing a better job at giving. Or at least Bebo founder Michael Birch is.

Birch has spent the last six months working with a team of two other people to build a social giving site for the popular organization, Charity:Water. It launched its beta site today, and with just a Tweet announcing it nearly 400 members have already raised some $3,000.

Charity:Water’s accountability and simplicity of purpose has made it a popular charity in New York, Hollywood and increasingly the Valley.  Here’s the value proposition: One-out-of-six-people on the planet doesn’t have access to clean drinking water. $5,000 buys an African village a well. Every dime you donate, goes to these wells. You can even watch the wells being tapped for the first time via Web video. The non-profit is turning three in a few weeks, and it’s raised more than $10 million over that time—much of it in $20 increments from a base of some 60,000 donors. It was Obama-fundraising-math before that was invented. As a result some 700,000 people in the world now have access to clean drinking water.

It was all started three years ago when Scott Harrison, reformed bad boy and Charity:Water founder, asked people to come to a huge New York party for his September birthday and donate $20 at the door instead of giving him a gift. He raised $15,000 and built six wells in Uganda. (They were cheaper than the wells Charity:Water usually builds because three were shallow wells and three were rehabs of existing wells.) Like any great accidental entrepreneur, Harrison knew he was on to something.

In addition to all kinds of creative fund raising, detailed in the video below, the following year, Harrison opened his birthday to everyone via the Web, asking them to donate $32 dollars, since it was his 32 birthday. That year, he raised $59,000 and other September birthday babies brought the total to $150,000, which went to wells in Kenya. Not bad, but they had to HTML hand-code each participant’s site. Pretty laborious work for a small non-profit.

The next year he got more September babies to “give up” their birthdays, and a company called InspEnv.com built them a site, but it wasn’t hugely social or scalable. Still 800 people “gave up” their birthdays and raised some $965,000 dollars to bring some 50,000 people clean water in Ethiopia.

But Harrison knew that the value of a lot of micro-giving campaigns like Kiva and the popular Facebook application, Causes, is rooted in the ability to make small donations super-easy to solicit and to make via existing online social graphs. He was trying to figure out sites that knew when a huge number of people’s birthdays were and after MySpace and Facebook, he came across Bebo. Early last year, he cold-emailed Bebo founder Michael Birch to ask if he’d be willing to send a note out to his September born users and Birch wrote back that it was “a bad time.” It was actually a great time for Birch—he was selling the company to AOL for $850 million.

Once the deal was done, Birch called Harrison and suggested he build him a site that could help people born in any month instantly “give up their birthdays” for Charity:Water’s mission. It was fitting since Birch’s next project was his pre-Bebo project, a site called Birthday Alarm. Nine months later, Harrison is about to turn 34, Charity:Water is turning three, and Birch has finished the site. For a free project, it’s a pretty nice looking site.

The recession makes this perfect timing. If you’re panicked about money and job loss, giving up your birthday is an easy way to give to those less-fortunate without having to spend a dime yourself. My husband has a September birthday and has already signed up. I plan to sign up for my birthday in December. You can create your own campaign in a matter of moments and with a few clicks, share it via all your existing social networks.

I’m sure the coders who were up until 4 a.m. last night will have mixed feelings about this, but this is one time I really want to see TechCrunch users break a beta site.

[Photo credit: Scott Harrison]

The story of charity: water – The 2009 September Campaign Trailer from charity: water on Vimeo.

Crunch Network: CrunchBase the free database of technology companies, people, and investors

A service called Joker Racer emerged as the big winner of the evening, but the other presentations weren’t too shabby either, with some of them earning special jury awards from various Japanese media. A good number of the fourteen services are available in English (or will be soon). Here’s a rundown on all of the companies that presented at WISH 2009:

Joker Racer (Winner: Grand Prix and Agile Media Network Award)
Joker Racer lets you remote-control model cars via your browser window, from anywhere in the world and in real-time. The Linux-powered and Wi-Fi-enabled model cars are equipped with GPS, a mini Linux server and a web cam mounted on top of them. It will even be possible to control the cars with the iPhone.

You can already register on the site but have to be patient until the official launch on August 26 when you want to take a spin. More videos can be viewed here.

Cerevo [JP] (Winner: Impress Award)
Cerevo presented an early version of a digital camera designed completely in-house that’s supposed to play with a photo sharing service the company is working on concurrently. The Wi-Fi-enabled “Cerevo cam” automatically uploads pictures to company servers without users needing to do anything. Pictures can then easily shared with friends (via cell phone email, for example) or uploaded to Flickr, Twitter and other sites. Expect both the Japanese and international version to launch probably later this year (read more about Cerevo here).

Action*Pad [JP] (Winner: CNET Japan Award)
Action*Pad is designed to be a simple to-do list that can be accessed by a group of people over the web (both fixed and mobile). Users just need to type in the URL and a password (registration isn’t necessary) to start getting things done. The service hasn’t officially launched yet.

Dressphile [JP] (Winner: Nikkei BP Award)
Dressphile is a combination of an offline and online business. Shopping addicts suffering from a lack of space in their apartments can either send in excess clothing or have it picked up. Dressphile will then store the clothes in its own storage facility at a monthly rate of $3 per item.

The company also offers a cleaning service and online database of your clothes, which are each pictured in a grid view. Dressphile is considering to let users choose to open these personal “online closets” to other people to sell off unneeded clothes that way.

Lang-8 (Winner: IT Media Award)
Lang-8 is a language exchange site with a social networking slant that’s been established in 2007. Available in 14 different languages, Lang-8 focuses on improving the writing skills in the language you study. Blog entries written in a foreign language can be viewed and checked by native speakers of that language. Read more about Lang-8 here.

xtel (Winner: Gizmodo Japan Award)
xtel is the name of a development support system for “ubiquitous contents” provided by Keio University in Tokyo. A total of four modules were presented: MOXA (a small I/O board), Talktic (compiler library for the development of applications on MOXA), Entity Collaborator (Java-based network to create network applications) and LIFE (server solution).

Tons of cool stuff the university created can be found in this bilingual PDF.

CONIT iPhone Content Payment System
CONIT presented a content payment system for the iPhone that should be of interest to many of the iPhone developers out there. The company has developed a solution that reduces costs for those developers offering subscriptions and and in-app purchases with their apps (new and existing ones). The system eliminates the need for setting up a content server. More in the English presentation embedded below.

Yonda4 [JP]
Yonda4 is a service that keeps track of books and comics you’ve read using Twitter. Just type the title of the book and add “@yonda4” to the tweet (it’s also possible to squeeze in a mini review). You can then access the Yonda4 website to see a list of your books and find users who have a similar taste. Android users can scan the barcode of a book and tweet its title instantly with Yonda4’s Android app.

Kokuban.in [JP]
Kokuban.in is a Flash-based “social drawing” service that lets users create images on a virtual blackboard with a mouse, “recording” the process from start to finish. The service launched last year, and there are now hundreds of thousands of animated clips on the site. CEO Yoshinori Munehara mainly talked about a new system that’s supposed to keep “impolite” comments on kokuban.in under control.

User Insight [JP]
User Insight is a web marketing tool that analyzes user behavior on a given site and visualizes the data collected with a heat map. The tool is supposed to answer the question what type of user (sex, age etc.) shows interests in which pages and which parts of those pages are clicked at the most. User Insight will go live next month, with versions in English and Chinese currently being in development.

Sony Bank’s “Jinseitsuuchou/Bankbook Of Your Life” [JP]
Sony Bank (an online bank operated by a Sony Japan subsidiary) presented a personal finance management system called Jinseitsuuchou, which roughly means “bankbook of your life” in Japanese. Just like the many other online finance trackers out there, the Sony tool helps users keep track of their personal expenses and budgets.

30min. [JP]
30min. is a location-based city guide portal that scrapes information on restaurants, shops and other service providers from the blogosphere. Based on where you are, 30min. delivers information on locations accessible within 30 minutes, enhanced by statements taken from blogs (currently, a whopping 8,000 blogs written by individuals are indexed). There’s also a free 30min. iPhone app [JP, iTunes link].

Nissan Carwings [JP]
A Nissan representative summarized the Web-related strengths of Carwings, Nissan’s (still) Japan-only and high-spec car navigation system: Display and text-to-speech conversion of RSS feeds, integration of Google Calendar, display of Google Maps information, integration of gas price comparison portal gogo.gs [JP] etc.

Link Knowledge [JP]
Link Knowledge is what appears to be a pretty powerful SaaS solution with a focus on CRM and SFA (sales force automation). The key idea is to scan information from business cards and feed it into a database, which can be accessed by Link Knowledge clients, i.e. direct marketers or sales people, to systematically identify potential customers.

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

If you look at the top right hand corner of any blog post on TechCrunch, you will see both the number of comments on it and the number of times it’s been retweeted (linked to and passed around on Twitter). Usually the retweet number is bigger than the number of comments because it is much easier to do. It counts as a vote for that post inasmuch as a passed link can be construed as a reader recommendation. Everyone who retweets a link is in effect recommending it to all of their followers, and it can help to drive traffic back to the original post. At least that is the theory.

But how many retweet buttons are actually out there and how many people click on them? When it comes to the spread of the buttons themselves, TweetMeme offered some stats today showing that its retweet buttons are now getting 1.6 billion impressions a month. That number has quadrupled in the past two months alone. New retweet market entrants have a lot of catching up to do. And Just wait until retweet buttons start appearing on individual comments as well.

What that means, however, is just that the buttons are appearing on blog posts and articles which collectively are viewed 1.6 billion times a month, not that they are clicked on that many times. I asked Tweetmeme founder Nick Halstead how many actual retweets do those buttons produce. He doesn’t have exact numbers for that yet, but his best guesstimate is 200,000 a day, or 6 million a month. That translates into a paltry 0.375 percent click-through rate.

There are a few caveats about this number. It doesn’t count people who click on the retweet button who are not members of Twitter. It only counts the overlap. So the actual number of clicks is no doubt higher. In fact, on the retweet button in RSS feeds and for people who are already logged into Twitter (which TweetMeme can measure), the click-through rate is 1 percent. But the vast majority of impressions are for people who are not logged in. So the real click-through rate is somewhere in between 0.375 percent and 1 percent.

The other thing to remember is that it can take fewer retweets to make an article go viral than, say, Diggs. Depending on how many followers each retweeter has and how many actually click on the link, a few retweets can be all it takes to drive a ton of people to that blog post. Twitter certainly drives a lot of traffic to TechCrunch, but we don’t really know how much of that is due to retweets.

TweetMeme is working on giving Websites who use its retweet button better insight into downstream traffic. Halstead also revealed that it is going to release an analytics service which measures traffic coming from retweets. He’d better hurry up with that before Twitter itself beats him to the punch.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

Google’s Enterprise Search offerings have steadily grown in both strength and innovation over the past few years. As we reported in June, Google now counts 25,000 enterprise search customers, up from last year’s 20,000 customers. Over half of customers use Google’s search appliance and the rest use its hosted site search and other enterprise products. Most recently, Google improved the scalability of its enterprise search appliance (also known as the GSA), allowing businesses to search billions of documents. Today, Google added two new tools for Google Enterprise Search: Side-by-Side search comparison and new connectors for the GSA, both available in Google’s Enterprise Labs, which is similar to Gmail Labs.

Side-by-Side search lets employees test and rate results from two different search queries (Policy A vs. Policy B) on the same data, to see which gives better results. Employees can vote on their preferred results, by clicking on either the Policy A or Policy B button and the administrator can then use that information to choose and set up the right search solution for the business. It seems that this feature would be useful to administrators who are constantly trying to make internal search capabilities more effective.

Google is also offering a new tool that lets businesses connect to different types of data, both online and offline, for search functionality. The GSA connector has been updated to search across content management systems of enterprises (such as SharePoint, FileNet, etc). Google also now provides a connector specifically for Salesforce data, so the GSA can include internal Salesforce data in search results.

Crunch Network: MobileCrunch Mobile Gadgets and Applications, Delivered Daily.

With the new Socialcast API, both internal IT folks or outside developers can extend the product with new functionality. And companies who are partners can expose their Socialcast activity streams to each other for cross-enterprise collaboration. Rather than just confining the stream to one organization, this would make it more like a true enterprise version of Twitter, or the recently acquired FriendFeed, where you may follow colleagues inside and outside your company. The API allows developers to build native clients or internal applications, accessing the Socialcast activity stream. To get access to the Socialcast API, you’ll have to already have an account, and from there, you’ll find all the information.

Socialcast Founder and CEO Timothy Young mentioned that Socialcast aims to be a platform, and not a tool like Yammer, or Twitter. Socialcast currently has over 7,000 companies, both free and paid accounts. When asked about the security of the API and Socialcast platform, Young acknowledged that security is a big concern and that Socialcast takes security very seriously with SSL encryption.

Socialcast has raised a total of $1.4 million from True Ventures and is based in the South Park area in San Francisco, Calif.

Crunch Network: CrunchBase the free database of technology companies, people, and investors

Sure everyone brings up LinkedIn and Facebook as the potentially huge homerun IPOs in the wings, but a lot of the companies queuing up look more like OpenTable.

The reservation Web site deserves props for making it out in a tricky time— the weekend it was picking its bankers one declared bankruptcy and another sold itself to a competitor. And yes, the price has impressively stayed above the $20 opening. But take a closer look at the deal: Only three million shares were floated to the public. No wonder the price has held– hardly anyone is in the stock. With a whopping 18 million still owned by insiders and investors, OpenTable looks more like a private company that just did another round of funding than a public company.

Given that insiders of other private companies are increasingly cashing out shares in later private funding rounds, is there practically a lot of difference returns-wise between a heady Series E or a small IPO with such a tiny float?

OpenTable’s real test will be what happens once insiders start selling to get liquidity.  CEO Jeff Jordan addressed that in his first post-quiet period interview, shot last week for my Yahoo show, TechTicker. (Clip below, around the seven minute mark.)

Jordan also notes at the two minute mark in this clip that since OpenTable priced, he’s been getting a flood of calls from Valley CEOs who are thinking about filing, so expect the mini-registration boom to continue. Actual returns for the beleaguered asset class, however, will be a different story.

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

A new music service called Spotify has attracted millions of users in a short time with the enticing lure of listening to any common song on your computer free. Meanwhile, the digital music grandpa Napster has quietly launched a $5 service that offers unlimited streaming plus free MP3 files.

A closer examination reveals that Spotify has raised tens of millions of dollars, given equity to the record labels, is under constant attack by hackers, uses clever P2P technology, is accruing enormous per song royalty obligations and has the seemingly impossible task of figuring out how to generate enough money from a free ad model to satisfy the music companies.

Here’s my admittedly biased look at both companies:

Spotify:

Spotify is a music service to browse and play songs from a library of 3.5 million songs. Users can create custom playlists, culling out their favorite songs and the service generally gets high marks for an intuitive user interface and peppy performance. It is a free ad supported service in which users get banner ads and audio ads. There’s also a $13/month premium level which gives you an advertising free experience. The service is available in U.K., Sweden, Norway, Finland, France and Spain and the premium service is available in other EU territories. U.S. access is not available although company representatives are saying it is coming.

Technology:

Unlike other web based services like imeem and Last.fm, Spotify requires a downloadable client available for Mac or Win computers. When songs are requested they are delivered from either the Spotify central servers or other users computers using P2P (peer to peer). This means Spotify will use your bandwidth even when you’re not listening music to service their other customers. They have filed a patent for this technology. Music is delivered using the Ogg Vorbis q5 codec at around 160Kbps which sounds nice and is also speedy to load.

Background:

Spotify was founded in 2006 by serial entrepreneurs Daniel Ek (previous CTO at Stardoll, founder of Advertigo and Evertigo among others) and Martin Lorentzon (one of two co-founders of Tradedoubler, the largest European online affiliate advertising company). Spotify is based in Luxembourg to avoid taxes although most of its employees are in Sweden, the UK and Romania.

Finances:

While Spotify has been tight lipped about financing amounts and sources details have leaked out and they reveal that Spotify has raised millions from its wealthy founders and tens of millions from venture capitalists. Similar to imeem, Myspace Music and Lala, the major labels own part of Spotify.

Security:

Since Spotify has 3.5 million songs it is an obvious target for hackers. There’s a battle pitting Spotify programmers against net hackers trying to decipher how the technology works. Code within the Windows version attempts to block debuggers so the Mac version is a more easy target. Several software programs have been released which download tracks from Spotify such as spotifysave and despotify. Spotify has is available in a limited number of countries, but its been well documented that the only check is on the initial signup page and its trivial to bypass. Users can easily bypass this by going to http://www.defilter.co.uk/ and entering the signup URL: https://www.spotify.com/en/get-started/ A UK mailing code like W1T 3EF  is required but users simply look those up athttp://www.postcodesearch.org.uk/

Economics:

The Spotify CEO boasted they have spent just £5,000 ($10,000) in total marketing the Spotify service in the UK and attracted 1 million users doing 10 million streams making it the cheapest and most effective service launch since Google. Missing from the calculation is the royalty obligation. Like all webcasters, Spotify must pay a per song fee for every song they play. These range from 1 cent per play (for interactive playback) to 0.2 cents (radio experience). While the rates seem modest they add up quickly. 10 million streams per day translates to $100,000 per day, $30mm/month and $360 million annually in royalties – just for the UK operation. Royalty rates are similar in other countries and its Spotify claims 1mm users from Sweden as well. Advertising from audio and banner ads cannot generate even a sizable fraction of these royalty obligation.

Spotify is a on quest to get paid monthly subscribers and has launched a $13/month service. They join a crowded field of competitors including Napster who recently relaunched their subscription service moving from $12.95 down to $5/month. The Napster service includes unlimited streaming like Spotify but also 5 free MP3s to add to your permanent collection each month.

Napster:

Literally weeks before the economic meltdown Napster was sold to electronics retailing giant Best Buy. Best Buy’s plan is to cost effectively market the Napster service to their large customer base. To achieve this, Napster had to move away from their limited Microsoft orphaned DRM service to a MP3 service. This would allow the service to work with all devices sold by the big box retailer. Recently, they announced a $5/month service where you can stream any song – much like Spotify – but you also get 5 free MP3s per month to add to your personal collection. Since most newer MP3s are $1.29 this is a cost savings in itself and the unlimited free streaming is a bonus. Users paying for an annual service can immediately download 60 tracks plus a bonus 10 making the cost of tracks 85 cents.

Like AmazonMP3 and itunes, Napster has a rich uncle to lean on to not only promote their service, but add other business segments to rationalize a low or no-margin digital music business. Apple sells ipods, Amazon sells other stuff while you’re shopping for MP3s and Best Buy can send you home with electronic gear they profit from selling. Using this financial flexibility Napster is able to offer an industry leading price point for a full streaming and MP3 service. This renders other services seem overly expensive and uncompetitive.

Future

Users have largely rejected paying a monthly fee for music subscriptions. The masses have ignored subscription services like Napster and Rhapsody which offer similar catalogs, some music portability and limited device support. Cheaper radio services like early paid Pandora have also been failures (although a desperate Pandora is bringing it back to try again). There’s little reason to believe that customers are willing to pay $13/month to stream music mostly to their PC. (Even Pandora estimates only 3% will pay a monthly fee.) This leaves Spotify with strictly an advertising-based business. Ad rates cannot generate revenues sufficient to pay even the mandated royalty rates much less all the costs of running a high tech business. Publicly Spotify is promising a US launch and mobile clients (iphone andAndroid) however this completely ignores the incongruity of the underlying economics. Current royalty rates are too expensive by 10-100x for an advertising business to work. This is why Youtube dropped music videos in the UK. Getting more users will not improve the upside-down economics.

Napster’s new service has lowered the bar dramatically to a modest $5/month for unlimited streaming and personal MP3 collecting. It’s not clear that Napster can generate a profit from this service, but as a tiny division of Best Buy it’s not clear they are required to. What is clear is the $5 price point means financial pressure on standalone digital music companies. The music selling and radio business is increasingly being commoditized. Profits are being squeezed to the point of unsustainability. This spells pending doom for imeem, Pandora, Myspace Music, Slacker and the newest entrant Spotify unless there is an industry-upheaving royalty rate change.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

Each time the company won, you heard two reactions from the crowd: fan boys screaming with joy and other companies’ founders groaning. “Too big for their boots,” was a phrase heard muttered a lot.

But player hating is just part of life as a hot start-up right? Of course – but Spotify is living in a particular dual reality. It’s caught between the rapture of music lovers who say it’s the site they always dreamed could exist and the cruel reality of the online music business.

And that meant there was a lot more drama than immediately meets the eye behind that reported $50 million funding and $250 million valuation. As one investor who ultimately passed on the deal told us, “This was one of those where you hold your nose and just pay up. Before you’ve done anything the majority of the economics are right out the door to the labels. You need huge scale to pay for all that, and then you’re still in bed with a bunch of numb nuts.”

Someone in the comments of TechCrunch’s previous Spotify story said it was Europe’s YouTube. We don’t know if they meant that in a good way or a bad way—but we agree on both. The problem with the comparison? YouTube found Google; a deep-pocketed public company that was also trying to build a video offering online and was willing to pay top dollar for YouTube’s streams, and their associated business model challenges.

Several VCs we talked to used the words “leap of faith” over-and-over again in describing the decision to invest in Spotify or not. In reality an investor has to take multiple leaps of faith to do this deal, especially at a $250 million valuation. Looking at those leaps explains why so many VCs who were awed by the product ultimately passed – and yet why a few ballsy investors saw the elusive upside worth the role of the dice.

Leap of Faith #1: The Labels Want an Apple Alternative. This seems like common sense, right? But how often do music labels act according to common sense? There’s a whole Internet graveyard full of online music start-ups that VCs invested $20 million or more in, cut deals with labels and the labels happily sucked them dry. It’s a good sign that the labels have been taking equity investments in Spotify, but that hardly makes it certain they’ll support the company. It’s common for big public companies to invest an immaterial amount in a promising start-up in order to keep a close eye on it.

According to people close to the company, the deals being negotiated with labels are similar to past subscription deals. There’s a minimum in royalties that has to be paid, and once that’s cleared there’s a more reasonable revenue share. But that minimum bar is so high, that’s where most subscription services have died. “The labels are entertaining how to work with them in a way everyone can make money, but they’re still clearly taking a pound of flesh,” said one person with knowledge of the negotiations.

Leap of Faith #2: Audio Advertising Will Shift from Radio to Online. So far, the money Spotify is getting from audio ads is likely to be “chump change – less than you could earn from those crappy ads at the bottom of instant messenger clients,” according to one industry expert we talked to. For the service to still have a free element, a larger-than-just-Spotify industry shift is going to have to occur where audio ads move from terrestrial radio to the Web in material amounts. We’re knee-deep in that shift in print, and only beginning to see it in online video. Will it happen in audio? Probably, but not next year.

Leap of Faith #3: Millions Will Pay for Subscriptions. That means the real opportunity for Spotify to build a business is the subscription model – something no online music company has succeeded at to date. Right now the company claims it has “just under 100,000 users” paying $10 a month. Other sources confirm that it’s growing at a fast clip. While impressive, the onerous costs from the labels mean that revenue – $12m a year, before that “crappy” audio ad money -  is not nearly enough. For this business to work Spotify needs millions of paying subscribers.

The fact is, Spotify is not only trying to break the online music subscription curse, they’re trying to do something few have done on the Web. To date people have shown themselves unwilling to pay for content and premium services en masse. Even the mighty Netflix only has 10 million subscribers; Match.com has less than 1 million. And again, thanks to the pressures from the labels, Spotify doesn’t have years to get there.

Leap of Faith #4: Apple Won’t Kick Spotify Off the iPhone; Other Mobile Carriers Will Champion it as an iTunes Alternative. Apple isn’t open. It’s territorial. And with good reason—it owns the dominant mobile Web and music platforms. Why on earth would it allow Spotify’s offline music player app to compete on its own hardware with iTunes?

That leaves other mobile devices to champion Spotify as an iTunes/iPhone alternative. That strikes us as highly likely. What’s more: People are more willing to pay $10 a month for a music app that’s not tethered to their computers. This would seem to be the company’s best bet to solve its business model woes and get enough future investment to hit scale.

Leap of Faith #5: US Launch Goes Well. Spotify is saying it will launch in the US by early 2010. That doesn’t seem feasible, given their business model challenges and the fact that this round was only 50 million. Investors who looked at the deal confirmed they’d need a much larger war chest to make that happen. Also, there is some confusion over whether the round is even closed at all – with some close to the company saying it’s still open but the company itself saying it has been closed for two weeks.

Much seems to depend on just how much demand there is to invest in Spotify, which is hard to read. The company claims that it got nine term sheets and a 20% premium on what we understand was a requested €150 million valuation. The latter appears to be true, but we know that the bulk of the major European VCs—including names like Balderton and Index that don’t normally balk at price if a company is good enough—turned down Spotify or offered a term sheet at a substantially lower valuation, due to all these leaps of faith. And, we contacted six of the top US consumer Internet partners who said they weren’t even pitched. This leaves us wondering from where these nine competitive term sheets came. In addition, the deal took a reported five months to close– unusual for a “hot” company.

There are certainly billions in cash in the world of private equity for promising companies, even in this economy. But it’s unclear how much more there is for Spotify while all these questions remain.

Leap of Faith #6: If All the Above Fails, Someone Buys the Company for $100 Million. In other words, what are the odds the incoming investors lose money? We think chances are good they’ll at least make their money back. After all no one disputes the beauty of the product or how many people love it. That’s clearly worth something even in a worst-case, fire-sale acquisition. Any investor worth their salt would have insisted on a liquidation preference given the risks and the high valuation attached to the deal.

It bears noting that while Spotify has been wildly promoting themselves in off-the-record conversations with the press (including us) they have been less than forthcoming with information publicly. In several weeks of reporting this story in the Valley and in London, we talked to more than a dozen people including investors who looked at the deal, people close to the company and other people in the online music industry. We’ve found a host of troubling contradictions that we tried to comb through for this story, with little help from Spotify.

We sent two emails to the company detailing the discrepancies we were hearing on both sides of the pond and got little back but a note saying the founders “wouldn’t comment on financial matters” and “didn’t like (our) tone.” This after their representatives had been providing us, off the record, with hype about subscription numbers and claims about term sheets and increased valuations.

Given the mass of uncertainties in the business and how many users love the service, it’d be nice to see the company be a bit more forthcoming about its future.

[Photo credit: Dirk Lindner for TechCrunch Europe]

Crunch Network: MobileCrunch Mobile Gadgets and Applications, Delivered Daily.

Google is finally figuring out that short links are just easier to deal with, especially on a mobile phone. No, it is not rolling out its own URL shortening service just yet (bit.ly, stand down). But today it is introducing what it calls “smart links” to the mobile version of Gmail.

When it recognizes a super-long link like the one for Google Maps shown above right, it will shorten it to the underlying name thing being linked to. In this case, it is an address (below right)

Basically, it translates the URL into English. Gmail’s smart links also work for direction destinations on Google Maps, and the names of YouTube videos and Google Sites pages. It is starting with Google-owned properties, where it knows the underlying names. But it doesn’t need to be limited to those.

It seems like a good idea and one which could be expanded to other links across the Web, including news headlines, image titles, Tweets, and countless other things. I kind of wish I could enable this feature in regular Gmail as well.

Crunch Network: CrunchBase the free database of technology companies, people, and investors

Is the worst behind us? The broad worldwide recession hit the venture capital and startup communities hard last year. Memories of the NASDAQ meltdown and venture capital “nuclear winter” earlier this decade sent everyone into a tizzy as they feared a repeat performance—venture dollars froze and hundreds of thousands of tech workers were laid off.

But it appears that the worst is over for now. Or at least, the broad indicators suggest that venture and entrepreneurial activity has stabilized and may in some cases be trending up. In Q2 2009 we tracked via CrunchBase a total of 400 estimated new startups founded, $6.4 billion in new venture capital financings and $15.8 billion in merger and acquisition activity. (Download the full report here for $195) And we only tracked 20,000 new layoffs, just 10% of the 200,000 we saw let go in Q1 2009.

Of course this could just be the calm in the eye of the storm, with significant additional turbulence up ahead. Venture capital returns continue to flatline—there are simply too many venture firms investing too much money, and the IPO market for startups remains effectively shuttered. We either need a path towards liquidity for startups or a much smaller venture capital market.

But the Q2 CrunchBase numbers make us cautiously optimistic.

For one thing, we estimate a rebound in the number of start-ups being founded (always a good sign). There were already 191 companies in CrunchBase founded in Q2 2009 (at the time we did our final data run) . We expect that number to reach more than 400 as a result of a normal lag in self-reporting.

Venture investments are also coming back. They increased 19% from $5.4 billion in Q1 to $6.4 billion in Q2 2009. This compares to $5.3 billion in Q2 deals counted by Dow Jones VentureSource and only $3.7 billion by Thomson Reuters in the MoneyTree Report which came out last night. (Each report is based on its own set of data and different methodologies). Although the trend is up from last quarter, our Q2 2009 data is 24% lower than Q2 2008.

The number of deals we tracked in the quarter was 516, a bit lower than the 560 in Q1, but the average deal size went up. Also, we saw a greater appetite for early stage investing, with the money going into Series A investments increasing 83 percent to $900 million. Series B investments still dominated with 104 deals totaling $1 billion. The average deal size was $12.4 million, with the median deal size at $5.5 million.

The M&A action is also starting to pick up. CrunchBase counted 214 exits totaling $15.8 billion for Q2 2009. Aggregate M&A volume is 50% higher than the Q1 total of $10.3 billion, though still down 40% from $25.8 billion a year ago. About half of that total, however, comes from a single transaction: Oracle’s $7.4 billion acquisition of Sun Microsystems (announced during the quarter, but still pending). Other large M&A deals included Glaxo SmithKline buying Stiefel for $3.8 billion, Intel acquiring Wind River for $884 million, OpenText snatching Vignette for $310 million and Intuit buying PayCycle for $175 million.

The full 35-page second-quarter report (including 29 interactive exhibits in excel and 33 PDF graphics) is available for $195 as a download here. This quarter, we added all our raw data and tables into excel files so readers can easily cut-and-paste charts into their own reports and slice-and-dice the data for their own use. We’ve also included a number of graphics that readers can use for third party publishing, linking is appreciated. Of course, you’re also welcome to grab the data free of charge through our CrunchBase open API.

See the report table of contents and a list of exhibits here.

BUY the Q2 2009 Report

$195

BUY the Annual Subscription (2008 Year In Review, Q1 2009 Report, Q2 2009 Report plus the Q3 2009 Report sent to you as soon as it is issued)

$495

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

The Twitter document leak fiasco started with a simple story that personal accounts of Twitter employees were hacked. Twitter CEO Evan Williams commented on that story, saying that Twitter itself was mostly unaffected. No personal accounts were compromised, and “most of the sensitive information was personal rather than company-related,” he said. The individual behind the attacks, known as Hacker Croll, wasn’t happy with that response. Lots of Twitter corporate information was compromised, and he wanted the world to know about it. So he sent us all of the documents that he obtained, some 310 of them, and the story developed from there.

This post isn’t about the confidential information taken from Twitter. It’s about exactly how Hacker Croll was able to get such deep access to Twitter in the first place.

It’s clear that Twitter was completely unaware of how deeply they were affected as a company – when Williams said that most of the information wasn’t company related he believed it. It wasn’t until later that he realized just how much and what kind of information was taken. It included things like financial projections and executive meeting notes that contained highly confidential information.

We’ve already said a lot about all of this and the related “server password = password” story that was discovered by another individual last week. But we’ve got two more stories to tell. The first, this post, is exactly how the hacks took place, based on information gathered from hours of conversations with Hacker Croll. The second is what was happening behind he scenes with Twitter as the story unfolded. We’ll post that later this week.

When the story first broke the true scope of what had taken place and how it occurred was not understood. Various bloggers speculated about the cause of the attack – with some placing the blame on Google while others blaming the rising trend of hosting documents in the cloud.

We immediately informed Twitter of the information we had in our possession (and forwarded it to them), and at the same time reached out to the attacker. With some convincing, the attacker responsible for the intrusion at Twitter began a dialog with us. I spent days communicating with the attacker in an effort to gain insight into how the attack took place, what the true scope of it was and how we could learn from it.

We’ve waited to post exactly what happened until Twitter had time to close all of these security holes.

Some Background

In the security industry there is a generally accepted philosophy that no system or network is completely secure – a competent attacker with enough time, patience and resources will eventually find a way into a target. Some of the more famous information security breaches have relied on nothing more than elementary issues exploited by an attacker with enough time and patience at hand to see their goal through. A classic example is the case of Gary McKinnon, a self-confessed “bumbling computer nerd” who while usually drunk and high on cannabis would spend days randomly dialing or attempting to login to government servers using default passwords. His efforts led to the compromise of almost 100 servers within a number of government departments. After McKinnon spent a number of years trawling through servers looking for evidence of alien life (long story), somebody within the government finally wised up to his activities which lead to not only the arrest and attempted extradition of McKinnon from the United Kingdom, but a massive re-evaluation of the security methods employed to protect government information.

A more recent example is the case of Kendall Myers, who after being recruited to work for the Cuban government by an anonymous stranger they met while on holiday in that country, set out to obtain a high ranking position within the State Department specifically to obtain access to US government secrets. Kendall dedicated his entire life to obtaining state secrets, and up until he was recently caught by the FBI had successfully passed on secret information and internal documents to the Cuban government for 30 years. He relied only on his memory, his education credentials and sheer dedication.

The Twitter Attack: How The Ecosystem Failed

Like other successful attacks, Hacker Croll used the same combination of patience, sheer determination and somewhat elementary methods to gain access to a frightening number of accounts and services related to Twitter and Twitter employees. The list of services affected either directly, or indirectly, are some of the most popular web applications and services in use today – Gmail, Google Apps, GoDaddy, MobileMe, AT&T, Amazon, Hotmail, Paypal and iTunes . Taken individually, most of these services have reasonable security precautions against intrusion. But there are huge weaknesses when they are looked at together, as an ecosystem. Like dominoes, once one fell (Gmail was the first to go), the others all tumbled as well. The end result was chaos, and raises important questions about how private corporate and personal information is managed and secured in a time when the trend is towards more data, applications and entire user identities being hosted on the web and ‘in the cloud’.

“Hacker Croll” is a Frenchman in his early 20’s. He currently resides in a European country and first discovered his interest in web security over two years ago. Currently in between jobs, he has made use of the additional time he now has, along with his acquired skillset, to break into both corporate and personal accounts across the web. His knowledge of web security has been attained through a combination of materials available to the public and from within a tight-knit group of fellow crackers who exchange details of new, and sometimes unknown, techniques and vulnerabilities. Despite the significance and impact a successful attack has, the cracker claims that his primary motivation is a combination of curiosity, exploration and an interest in web security. There is almost a voyeuristic tendency amongst these individuals, as they revel in the thought of gaining privileged access to information about the inner lives of individuals and corporations. The “high” of access and gaining unauthorized knowledge must be big enough to carry a cracker’s motivation through the long hours, days and months of effort it may take to hit the next pot of gold.

For Hacker Croll, his first port of call in setting out to gain access to a target network is to make use of public search engines and public information to build a profile of a company or individual. In the case of the Twitter attacks, this public information allowed him to create a rich catalog of data that included a list of employee names, their associated email addresses and their roles within the company. Information like birth dates, names of pets and other seemingly innocent pieces of data were also found and logged. This dragnet across the millions of pages on the web picked up both work and personal information on each of the names that were discovered. Public information on the web has no concept of, or ability to, distinguish between the work and personal details of a person’s identity – so from the perspective of a cracker on a research mission, having both the business and personal aspects of a target’s digital life intertwined only serves to provide additional potential entry points.

With his target mapped out, Hacker Croll knew that he likely only needed a single entry point in any one of the business or personal accounts in his list in order to penetrate the network and then spread into other accounts and other parts of the business. This is because the web was designed at a time where there was implicit trust between its participants – requiring no central or formal identification mechanism. In order to keep private data private, modern web applications have built out their own systems and policies that require a user to register and then manage their identities separately with each app. The identifier that most applications use is an email address, and it is this common factor that creates a de facto trust relationship between a user’s applications. The second factor is a password: a random string that only the user knows, is unique to each application, and in theory should take even a computer months or years to figure out if it started guessing. These two elements would work well enough for most cases, were it not for what is often the single weakest factor: human habit.

Look at the front page of almost any web application and you will see hints at just how hopeless and helpless we are in managing our digital lives: “forgot my password”, “forgot my username”, “keep me logged in”, “do not keep me logged in”, “forgot my name”, “who am i?”. Features that were designed and built as a compromise since we are often unable to remember and recall a single four-digit PIN number, let alone a unique password for every application we ever sign up for. Each new service that a user signs up for creates a management overhead that collapses quickly into a common dirty habit of using simple passwords, everywhere. At that point, the security of that user’s entire online identity is only as strong as the weakest application they use – which often is to say, very weak.

Now going back to Hacker Croll and his list of Twitter employees and other information. Twitter just happens to be one of a number of a new breed of companies where almost the entire business exists online. Each of these employees, as part of their work, share data with other employees – be it through a feature of a particular application or simply through email. As these users become interwoven, it adds a whole new attack vector whereby the weak point in the chain is no longer just the weakest application – it is the weakest application used by the weakest user. For an attacker such as Hacker Croll looking to exploit the combination of bad user habit, poorly implemented features and users mixing their personal and business data – his chances of success just got exponentially greater. Companies that are heavily web based rely largely on users being able to manage themselves – the odds are not only stacked against Twitter, they are stacked against most companies adopting this model.

Unfortunately for Twitter, Hacker Croll found such a weak point. An employee who has online habits that are probably no different than those of 98% of other web users. It began with the personal Gmail account of this employee. As with most other web applications, the personal edition of Gmail has a password recovery feature that presents a user with a number of challenges to prove their identity so that their password can be reset. It likely wasn’t the first account from a Twitter employee that Hacker Croll had attempted to access – but in the case of this particular account he discovered a kink in the armor that gave him the big first step. On requesting to recover the password, Gmail informed him that an email had been sent to the user’s secondary email account. In an effort to balance usability with security, Gmail offered a hint as to which account the email to reset the password was being sent to, in case the user required a gentle reminder. In this case the obfuscated pointer to the location of the secondary email account was ******@h******.com. The natural best guess was that the secondary email account was hosted at hotmail.com.

At Hotmail, Hacker Croll again attempted the password recovery procedure – making an educated guess of what the username would be based on what he already knew. This is the point where the chain of trust broke down, as the attacker discovered that the account specified as a secondary for Gmail, and hosted at Hotmail was no longer active. This is due to a policy at Hotmail where old and dormant accounts are removed and recycled. He registered the account, re-requested the password recovery feature at Gmail and within a few moments had access to the personal Gmail account of a Twitter employee. The first domino had fallen.

Well designed web applications will never just give a user their password if they forget it, they will force the user to pick a new one. Hacker Croll had access to the account, but with a password he had specified. To not alert the account owner that their account had been compromised, he had to somehow find out what the old Gmail password was and to set it back. He now had a bevy of information at his fingertips, a complete mailbox and control of an email account. It wasn’t long before he found an email that would have looked something like this:

To: Lazy User
From: Super Duper Web Service
Subject: Thank you for signing up to Super Duper Web Service

Dear Lazy User,

Thank you for signing up to Super Duper Web Service. For the benefit of our support department (and anybody else who is reading this), please find your account information below:

username: LazyUser
password: funsticks

To reset your password please follow the link to.. ahh forget it, nobody does this anyway.

Regards,

Super Duper Web Service

Bad human habit #1: Using the same passwords everywhere. We are all guilty of it. Search your own inbox for a password of your own. Hacker Croll reset the password of the Gmail account to the password he found associated with some random web service the user had subscribed to and that sent a confirmation with the password in clear text (and he found the same password more than once). He then waited, to check that the user was still able to access their account. Not too long later there was obvious activity in the email account from the account owner – incoming email read, replies sent and new messages drafted. The account owner never would have noticed that a complete stranger was lurking in the background. The second domino falls.

From here it was easy.

Hacker Croll now sifts through the new set of information he has access to – using the emails from this user’s personal Gmail account to further fill in his information map of his target. He extends his access out to all the other services he finds that this user has signed up for. In some instances, the password is again the same – that led Croll into this user’s work email account, hosted on Google Apps for Domains. It turns out that this employee (and in fact most/all Twitter employees and everyone else) used the same password for their Google Apps email (the Twitter email account) as he did with his personal Gmail account. With other sites, where the original password may not work – he takes advantage of a feature many sites have implemented to help users recover passwords: the notorious “secret question”.

Fork the story here for a moment because there is a real issue here with the “secret question” (from here on abbreviated more appropriately as just “secret ?”). For some strange reason, some sites refer to the “secret ?” as an additional layer of security – when it is often the complete opposite. In the story of Hacker Croll and Twitter, the internal documents that we now all know about were only a few steps away from the first account he gained access to. In addition to that, this attacker, and certainly others just like him, have been able to demonstrate that some of the biggest and most popular applications on the web contain fundamental weaknesses that alone might seem harmless, but in combination with other factors can cause an attacker to completely tear through the accounts of users, even those who maintain good password policy.

This is not the first time that the issue of “secret ?” being used in password recovery systems has been raised. Last September, US Republican Vice Presidential candidate and former governor of Alaska, Sarah Palin, had screenshots of her personal Yahoo mail account published to Wikileaks. A hacker or group known only as ‘Anonymous’ claimed credit for the hack, which was carried out by the attacker making an educated guess in response to the security question used to recover passwords. In early 2005, celebrity Paris Hilton suffered a similar incident when her T-Mobile sidekick account was broken into, and the details of her call log, messages (some with private pictures of Hilton) and contact list were leaked to the media. The culprit, again, was “secret ?”.

Giving the user an option to guess the name of a pet in lieu of actually knowing a password is just dramatically shortening the odds for the attacker. The service is essentially telling the attacker: “we understand that guessing passwords is hard, so let us help you narrow it down from potentially millions of combinations to around a dozen, or even better, if you know how to Google, just one”. The problem is not the concept of having an additional authorization token, such as mothers maiden name, that can be used to authenticate in addition to a password, the problem arises when it is relied on alone, when the answer is stored in the clear in account settings, and when users end up using the same question and answer combination on all of their accounts.

From this point, with a single personal account as a starting point, the intrusion spread like a virus – infecting a number of accounts on a number of different services both inside and outside of Twitter. Once Hacker Croll had access to the employee’s Twitter email account hosted by Google, he was able to download attachments to email that included lots of sensitive information, including more passwords and usernames. He quickly took over the accounts of at least three senior execs, including Evan Williams and Biz Stone. Perusing their email attachments led to lots more sensitive data being downloaded.

He then spidered out and accessed AT&T for phone logs, Amazon for purchasing history, MobileMe for more personal emails and iTunes for full credit card information (iTunes has a security hole that shows credit card information in clear text – we’ve notified Apple but have not heard back, so we won’t publish the still-open exploit now).

Basically, when he was done, Hacker Croll had enough personal and work information on key Twitter executives to make their lives a living hell.

Just to summarize the attack:

1. HC accessed Gmail for a Twitter employee by using the password recovery feature that sends a reset link to a secondary email. In this case the secondary email was an expired Hotmail account, he simply registered it, clicked the link and reset the password. Gmail was then owned.
2. HC then read emails to guess what the original Gmail password was successfully and reset the password so the Twitter employee would not notice the account had changed.
3. HC then used the same password to access the employee’s Twitter email on Google Apps for your domain, getting access to a gold mine of sensitive company information from emails and, particularly, email attachments.
4. HC then used this information along with additional password guesses and resets to take control of other Twitter employee personal and work emails.
5. HC then used the same username/password combinations and password reset features to access AT&T, MobileMe, Amazon and iTunes, among other services. A security hole in iTunes gave HC access to full credit card information in clear text. HC now also had control of Twitter’s domain names at GoDaddy.
6. Even at this point, Twitter had absolutely no idea they had been compromised.

What could have happened next is that Hacker Croll could have used or sold this information for profit. He didn’t do that, and says he never intended to. All he wanted to do, he says, was to highlight the weaknesses in Twitter’s data security policies and get them and other startups to consider more robust security measures.

He also says he’s sorry for causing Twitter so much trouble. We asked Hacker Croll if he had any message he wants to deliver to Twitter, and he sent me the following:

Je tiens à présenter toutes mes excuses au personnel de Twitter. Je trouve que cette société a beaucoup d’avenir devant elle.

J’ai fait cela dans un but non lucratif. La sécurité est un domaine qui me passionne depuis de longues années et je voudrais en faire mon métier. Dans mon quotidien, il m’arrive d’aider des gens à se prémunir contre les dangers de l’internet. Je leur apprend les règles de base.. Par exemple : Faire attention où on clique, les fichiers que l’on télécharge et ce que l’on tape au clavier. S’assurer que l’ordinateur est équipé d’une protection efficace contre les virus, attaques extérieures, spam, phishing… Mettre à jour le système d’exploitation, les logiciels fréquemment utilisés… Penser à utiliser des mots de passe sans aucune similitude entre eux. Penser à les changer régulièrement… Ne jamais stocker d’informations confidentielles sur l’ordinateur…

J’espère que mes interventions répétées auront permis de montrer à quel point il peut être facile à une personne mal intentionnée d’accéder à des informations sensibles sans trop de connaissances.

Hacker Croll.

This roughly translates to:

I would like to offer my personal apology to Twitter. I think this company has a great future ahead of it.

I did not do this to profit from the information. Security is an area that fascinated me for many years and I want to do my job. In my everyday life, I help people to guard against the dangers of the Internet. I learned the basic rules .. For example: Be careful where you click the files that you download and what you type on the keyboard. Ensure that the computer is equipped with effective protection against viruses, external attacks, spam, phishing … Upgrading the operating system, software commonly used … Remember to use passwords without any similarity between them. Remember to change them regularly … Never store confidential information on the computer …

I hope that my intervention will be repeated to show how easy it can be for a malicious person to gain access to sensitive information without too much knowledge.

Croll hacker.

What’s the takeaway from all this? Cloud services are convenient and cheap, and can help a company grow more quickly. But security infrastructure is still nascent. And while any single service can be fairly secure, the important thing is that the ecosystem most certainly is not. Combine the fact that so much personal information about individuals is so easily findable on the web with the reality that most people have merged their work and personal identities and you’ve got the seed of a problem. A single Gmail account falls, and soon the security integrity of an entire startup crumbles. So for a start, reset those passwords and don’t use the same passwords for different services. Don’t use password recovery questions that can easily be answered with a simple web search (an easy solution is to answer those questions falsely). And just in general be paranoid about data security. You may be happy you were.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

Crunch Network: MobileCrunch Mobile Gadgets and Applications, Delivered Daily.

If you look at technologies trending with teens right now, it’s Apple devices (iPhone, iPod), smart phones (Blackberry, Palm), and then social networks (Facebook and MySpace). At least that’s what I see from hanging out with 1,500 other teenagers in high school every day (I am 16 years old). But why not Twitter? Well, because Twitter is a different type of social network than Facebook. Facebook is about connecting people, and sharing information with each other. The way my friends and I see it, Facebook is a closed network. It’s a network of people and friends that you trust to be connected to, and to share information like your email address, AIM screen name, and phone number. You know who’s getting your status messages, because you either approved or added each person to your network.

With Twitter, it’s the exact opposite. Anyone can follow your status updates. It’s a completely open network that makes teenagers feel “unsafe” about posting their content there, because who knows who will read it. Sure, you get emails notifying you when you have new followers, but that doesn’t compare to the level of detail you get when someone on Facebook adds you, and you get their information.

According to June, 2009 comScore numbers, 11.3% of visitors to Twitter.com in the U.S. are ages 12-17. Internationally, in May, 2009, only 4.4% of visitors were younger then 18.

Twitter is also seen as more expensive to keep up with than Facebook. Most of my friends spend their time playing video games, watching TV, surfing online, and text messaging to actual friends who you know will reply back. In an economy like this, most parents don’t want to spend the extra money on unlimited texting to total strangers. So why spend money on sending SMS updates to Twitter, when you can send updates to someone you know will read it and reply?

Facebook has a more dedicated community than Twitter, which is why teenagers want to use it. Maybe the reason Twitter still isn’t considered mainstream quite yet is because Gen Y isn’t the early adopter this time around.

Crunch Network: CrunchBase the free database of technology companies, people, and investors

Update: We’ve got the photos up for you to check out.

Thank you to all of you who came out to support the 2009 Summer CrunchUp! We broke 600 attendees to the Real Time Stream CrunchUp, double our initial expectations, and we hosted lots more of you at the August Capital outing.

In typical TechCrunch style, it was a work-hard, play-hard day. Thank you to all our CrunchUp speakers for investing your time with us to talk about new trends, boundaries and your passions. Plus we fit in 22 new product highlights from start-ups and big internet companies alike.

If you missed the CrunchUp, the video is on the CrunchUp site, courtesy of Ustream. Both they and FutureWorks did an amazing job to help us stream and record Real Time for future use. We live blogged as much of the conference as possible. In case you missed yesterday:

The Real-Time Opportunity, including Ron Conway’s Top Ten List of Monetization Opportunities
The Real-Time Moment
Real-Time Search
Real-Time Mobs (and Syphilis)
Real-Time Business
Real-Time Roundtable
Demos and announcements. including:
Tweetdeck Funding
Microsoft Silverlight
PeopleBrowsr
Brizzly, from Thing Labs
Seesmic Browser Client
Bantam Live
Camtweet, from Justin.tv
Qik Push API
ECHO, from JK-Kit
12seconds.tv
Mag.ma

You can also watch videos of the entire event on the CrunchUp channel on Ustream.

Additional archives are on the CrunchUp site. We incorporated real-time widgets and services, from CrunchUp sponsors Tinker, cc:Betty and Tokbox. Thanks again to Charles River Ventures and Microsoft BizSpark for helping to underwrite the CrunchUp.

August Capital was unbridled start-up networking and fun. As usual, we are indebted to David Hornik and the partners at August Capital for allowing we hooligans onto their beautiful back deck under the premise of business socializing.

We did manage to get a bit classy this year. Grey Goose Vodka hosted an amazing martini bar for us, complete with ice sculpture. (We were told the last time Grey Goose did an ice-sculpture, it was for Tiger Woods, so we’re super proud of our TechCrunch in ice.) cc:Betty’s founder Michael Cerda shared his latin jazz band, El Desayuno with us. Between sets, Pandora rocked the house with music. Silver Moon Desserts shared mini, gourmet ice-cream cones. Stormhoek provided wine and Groovy provided the beer and other refreshments. Friendster hosted an amazing caricature mural of attendees with artists who recorded hundreds of attendees. Gaping Void’s Hugh Macleod shared his Dream Big lithographs with attendees (a large-format serigraph a Dream Big was auctioned off during the CrunchUp, and picked up by Bantam Live founder John Rourke in honor of his company’s launch. Benefits to the EFF.) Lots of other start-up demos ran the length of the deck.

Eye.fi took pictures on behalf of Microsoft BizSpark’s photo wall. Catch them on flickr. Please tag your photos of the conference and social with crunchup (also techcrunch, august capital, 2009.)

Share your photos and posts about your CrunchUp experience, and we’ll add links to them here.

Thanks again for sharing your own ideas and energy at the CrunchUp. Events like this keep our adrenaline up at TechCrunch. We’ll do another one soon.

Lots more photos below.

Thank You To Our CrunchUp Sponsors Who Made It All Possible

Product Sponsors: Glam Media Lab’s Tinker live conversation moderation, Tokbox live video chat, Ustream live video streaming, Bantam Live, Charles River Ventures, Microsoft BizSpark and mailspace cc:Betty.

Demonstration Sponsors: Seesmic, OneRiot, PeopleBrowsr, Mashery, IDrive, Sun Start-Up Essentials, Meraki, SocialFeet, Tapulous, Loopt, Grey Goose Vodka, Future Works, Gaping Void, Stormhoek Wines, Silver Moon Desserts, Friendster, LifeIO, Groovy and ODesk.

Event Sponsors: Eventbrite for ticketing and MediaTemple for hosting, Topix, Orange, AIM/AOL, ReTargeter, NewTek, Coveroo, Pandora.

More photos:

Michael Arrington sweeps Randi Zuckerberg off her feet:

Michael Arrington (left), Ron Conway, John Borthwick:

Twitter creator Jack Dorsey on stage:

CrunchUp Crowd:

Grey Goose ice sculpture:

No idea, but I love it:

More photos from:
Brian Solis: Great shots from each the Real-Time Stream CrunchUp, http://is.gd/1vZJN, and August Capital Outing, http://is.gd/1vZLM

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

PeopleBrowsr, a desktop and web browser-based dashboard for social networks, is adding a real-time search functionality that would let users make filtered searches into conversations on Twitter, Facebook and FriendFeed.

Launched at TechCrunch’s Real-Time Stream CrunchUp, the search engine is particularly useful to brands and companies looking to have insight into the conversations about their businesses taking place on the social graph. Designed to unearth conversations around particular keywords, the search engine also offers further filtering options. Search results can be filtered by topic, geography and authority.

PeopleBrowsr’s technology crawls a plethora of data from social networks, including links in messages, Twitter bios, authority (determined by number of followers), real-time trending topics, and sentiment. PeopleBrowsr then lets users directly engage with the people who appear in the search results across multiple social networks via public response, personal direct messages, retweets, and reposts.

As I wrote in my earlier review of the desktop client, PeopleBrowsr’s client is targeted towards use in the enterprise space, which is smart considering the current rat race in the Twitter client arena. I’m sure the real-time capabilities only make PeopleBrowsr’s offering more appealing to brand managers or clients. PeopleBrowsr’s “Smart Cache” real-time indexes high volumes of conversations (1,000 new posts per second) and trends them into 1 minute, 10 min or 1 hr increments. Results are also embeddable, allowing users to integrate results in a widget to be placed in reports or posts.

There’s no doubt that with the companies, restaurants, brands and celebrities all using Twitter and Facebook as business platforms that real-time, powerful search across these networks will be a boon to brand managers and communications teams. Startup ViralHeat also crawls the web, Twitter and video sites for real-time mentions of keywords but doesn’t yet have capabilities for Facebook and FriendFeed.

Here’s the demo video of PeopleBrowsr from the Real-Time Stream CrunchUp:

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

Users can share music files, photos or videos across (almost) any device via drag and drop and share the files with others. DoubleTwist’s main selling point: It supports hundreds of devices, from cell phones or mobile gaming devices to portable music players. For example, the software can sync all music files you bought on iTunes with your Blackberry, Nokia phone, Kindle or Sony PSP without you having to worry about file format compatibility. Media files can then be uploaded to sites like Flickr, Facebook or YouTube from within doubleTwist.

Watch this video to see how the app works:

It’s safe to say Apple isn’t probably a big fan of the software. But doubleTwist co-founders Monique Frantzos and Jon Lech Johansen (better known as DVD Jon) silently enhanced the app in the last few weeks and told me today they have more plans for the future.

doubleTwist added support for video downloads from YouTube and now works with Android phones and the Palm Pre, too. Drag and drop any YouTube video you want to watch on the go on your Android G1, for example, into the doubleTwist window and copy it onto your device in seconds. iPhone 3.0 compatibility, bundling deals with several cell phone makers and a more sophisticated podcast engine are to be expected in the near future, too.

Entry into gadget-crazy Japanese market
Things are going very well for doubleTwist in the English-speaking world, and starting today, the application is available as a localized version in mobile phone-crazy Japan (Windows-only for the time being/demo video). According to Johansen and Frantzos, the main reasons for choosing Japan as the first Non-English market are:

• a myriad of super-advanced cell phones from different makers (about 100 a year) delivering a mediocre software experience
• world’s highest penetration of iTunes (1 out of 4 broadband users or about 13.6 million Japanese use iTunes to manage their music)
• high online video consumption (21 million Japanese users watch YouTube videos for 187 minutes per month as opposed to Americans who are on YouTube for 134 minutes monthly)
• strong demand for high-quality online video (mobile YouTube delivers low quality but doubleTwist can show YouTube videos in high-res)

doubleTwist’s entry into Japan makes sense, as the country is one of the world’s biggest markets for music and movies (for example, Japanese users downloaded music worth $10.2 billion to cell phones in 2007). Nearly 170 Japan-only cell phones from local carriers NTT Docomo, KDDI au and SoftBank are supported from the start. DoubleTwist has set up a Wiki page for each one of them, an exclusive pilot service for the Japanese market that might be expanded to all doubleTwist-compatible devices in the future.

The company has so far raised $7.5 million in series A and B from several major venture capital companies in the US, Europe and Asia, including Index Ventures (investors in Skype) and Hong Kong-based Horizons Ventures.

Crunch Network: MobileCrunch Mobile Gadgets and Applications, Delivered Daily.

After Google dropped its Chrome OS bomb yesterday, the news that Google is working on a new operating system generated a media frenzy. Our own MG Siegler covered the news from all angles, and did a live interview on Attack of The Show (embedded above).

As MG points out in the interview, this is just an entry point for Google (netbooks today, PCs tomorrow), and the announcement was expertly timed to take some of the attention away from Microsoft’s expected Office-in-the-cloud announcement next week.

Crunch Network: CrunchBase the free database of technology companies, people, and investors

It looks like PayPal is rolling out a more flexible payments API called Adaptive Payments. We’ve obtained a confidential document, which is embedded below, explaining the details of the new system.  Basically the API is designed to give developers full access to PayPal’s features, allowing them a lot more freedom in building applications which include the ability to accept and distribute payments.

Very similar to Amazon’s Flexible Payments Service (FPS), the Adaptive Payments API handles payments between a sender of a payment and one or more receivers of the payment.   Adaptive Payments allows almost the same functionality as FPS. The new API lets developers become a payment aggregator, which we are told is something against PayPal’s current Terms of Service. Amazon’s FPS also lets developers aggregate payments. Moreover, Paypal’s Adaptive Payments has built in micropayments support, another feature of FPS.

Some of the offerings of Adaptive Payments are sure to be attractive to developers. In what PayPal calls “Chained Payments,” developers can create applications that enable a sender to send a single payment to a primary receiver who may keep part of the payment and pay other, secondary receivers with the remainder of the funds. For example, an application might be an online travel agency that handles bookings for airfare, hotel reservations, and car rentals. The sender sees only the travel site as the primary receiver. But that site could allocate the payment for its commission and the actual cost of services provided by other merchants. PayPal would deduct the money from the sender’s account and deposit it in both the primary travel site’s account and the secondary receivers’ accounts.

Adaptive Payments will also offer “Parallel Payments,” which would let a sender send a single payment to multiple receivers. An example of this type of application might be a shopping cart that lets a buyer pay for items from several merchants with one payment. The shopping cart would allocate the payment to the merchants who actually provided the items. PayPal would then deduct money from the sender’s account and deposits it in the receivers’ accounts.

It’s unclear what PayPal’s pricing plan will be for Adaptive Payments and if it will be competitive with Amazon’s FPS pricing. Amazon has slowly been rolling out its competition to PayPal over the past few years, launching Amazon Payments and unveiling the beta of FPS. It isn’t easy for Amazon to replace PayPal, but it is going after developers to become the preferred payment mechanism on the Web. Perhaps PayPal is starting to feel the heat from FPS, which allows much more flexibility than PayPal’s Direct Payments API. Now, with its Adaptive Payments API in the works, PayPal is about to strike back.

Adaptive Payments –

Crunch Network: CrunchBoard because it’s time for you to find a new Job2.0

A new study says there’s some truth to that. Seriously. According to Dr. Helen Fisher, biological anthropologist and chief scientific adviser to Chemistry.com, regular sex can make you a better worker bee. The dopamine rush from sex improves creativity making you a better problem solver. A boost of oxytocin and vasopressin generate feelings of trust, making you more likely to be a team player. And, a boost in testosterone can make you more confident and competitive.

Yep, sounds like a dude wrote the study. But, hey, if it’s true, maybe there’s a productivity justification for all that porn online.

Crunch Network: CrunchGear drool over the sexiest new gadgets and hardware.

Forgive the slightly blurry shots, consider this a test of the iPhone 3GS camera at live events. (There are some slightly better ones at the bottom.)

Crunch Network: MobileCrunch Mobile Gadgets and Applications, Delivered Daily.