Blog

Did you participate in a program where Sears paid you to participate in a research project that monitors your online browser activity? Well, if so, you will be happy to hear that the FTC has ordered Sears to destroy that data because they weren’t forthcoming about exactly what information they were collecting.  As it turns out, they collected things like online banking session data, prescription drug purchases, emails, etc. Who knows if Sears really intended to get this information or just didn’t think through the whole thing and after the collection began they were like “holy crap, look at what we have here”, I don’t know. Either way, I am glad that organizations are being penalized for doing this type of thing.

There was a big win a couple of weeks ago when a federal court judge decided Clear (the travel identity company that made it easier to get through airport security) could not sell customer data.  The contracts stated that they would not sell customer data but they made an announcement on their website that stated they were looking for someone to sell the data to that could provide a similar service. Outraged customers immediately filed suits that they will likely win (if there are any assets left). It really bothers me when a company assumes that when a customer gives them their data, they can do whatever they want with it. My opinion is that this is the customer data and businesses are just stewards of that data and shouldn’t be allow to do whatever they want with it…especially if it is sensitive data like in this case. I think this is good for everyone (except maybe the Clear shareholders).

I travel more than my fair share, but was never wooed by other travelers into signing up for “Clear” the approved frequent traveler program that allows travelers to speed their way through long security lines at U.S. airports. I have never felt good about a program like this…especially when a slight convenience can lead to the debacle they are now in. As some of you know, “Clear” went out of business suddenly a few weeks ago. Now the 260,000 customers of Clear are left wondering what will become of the information they provided to the company including Social Security numbers (SSNs), credit card numbers, driver’s license numbers, iris scans and fingerprints.

We as a society are all-to-often willing to trust other people or companies with our very identities. While this is scary enough, doing it for the purpose of saving a couple of minutes in line at the airport seems a bit reckless. But I believe that this might be just the first minor step in a much larger program that everyone may be required to participate in. Obama passed the HITECH healthcare law in February of this year that promotes the creation of a national healthcare system. This system will be tied to identities of participants…which will likely be all Americans, or nearly all Americans. Whether this will turn out good or bad remains to be seen.

The real problem of course is what they do with the data. In a more recent article, Clear said it may sell its sensitive customer data to a similar provider if it’s authorized to do so by the US government.

It just shows that when you turn this type of information over to a provider, you really don’t know where it will end up, or what it might be used for.

Now U.S. Legislators want to know what the company plans to do with the information. In a letter dated June 25, 2009, Representative Bennie Thomas (D-Miss.), chairman of the House Homeland Security Committee, expressed concern about the security of the collected data and asked the TSA to describe its plans to secure the data.

I read an interesting article recently about how researches have “essentially” broken the code for social security number distribution.  I say essentially, because it isn’t perfect, which the social security administration was quick to point out.  This is what happened.  You can now search for deceased persons online and get their social security numbers.  What the group did was take a list of these individuals that were more sequentially in specific states and then using computer algorythms, figured out the basic method the government uses to assign SS#.  It wasn’t a perfect science, but had quite remarkable results.  The accuracy largely depended on the population of the state you were born in (or got your SS# in).  Obviously the smaller the population, the easier it was to accurately guess.  What this means is that if someone learns where you were born, and what your birth date is, it wouldn’t be very difficult to figure out your social security number.  Social security numbers are of high value (in conjuction with other information like name, address, birthday, etc.) to criminals to perform fraud and identity theft.  This could make it quite a bit easier for criminals to gain this usually (more) illusive piece of information.  The Social Security Administration said that they are currently working on a process that will randomly select SS#’s rather than systemically assigning them.  Of course they didn’t mention that all the SS#’s that have been assigned systematically over the past decades will always be subject to this system of discovery.

Beware with fraud and identity theft being at all time highs, something like this (if it gets into the hands of criminals) can make it grow at an even faster pace.  Check your credit often as this type of data would most often be used to create new accounts.

The FBI has released their 2008 Internet crime report.  The information contained therein is from complaints made to the FBI regarding fraud that was sourced from the Internet.  There is quite a bit of good information in this report, but here are some of the highlights that I found interesting.

2008 had the highest number of complaints reaching 275,284.  This is a 33% increase over 2007 levels.

Total financial loses were $264 million with a median dollar loss of 931 per complaint.  Again, this was higher than 2007 numbers.

Non delivery of merchandise and online auction fraud accounted for more than 50% of complaints.  Other fraud types included credit/debit card fraud, confidence fraud, computer fraud, check fraud, and even Nigerian letter fraud (as opposed to all the legitimate Nigerian letters we all get).

Highest losses were check fraud at a median loss of $3000.  Nigerian letter fraud accounted for a median loss of $1,650.

Three quarters of perpetrators were men.  Two thirds of all perpetrators were in the United States. Half of all perpetrators were in one of the following states: California, New York, Florida, Texas, District of Columbia, and Washington.  Most of these being the most highly populated states shouldn’t surprise anyone.

Complainants were almost nearly split between men and women, but the men edged out by 55%.  Half of all of the complaints came from those ages 30 to 50.

Men seemed to lose more than women in these incidents by between 25-35 percent.

Probably most interesting is that 74 percent of all fraud complaints were sourced through email.  Nearly 29 percent included web sites.  I think the lesson to learn here is that a good SPAM filter, and web content filtering can reduce fraud.  If you can limit the amount of SPAM getting to your employees desktops, and block their access to inappropriate websites, you could be saving them thousands of dollars.  This also increases their productivity.  It does this in general, but also imagine the number of hours (often work hours) that they will use to fight whatever fraud they experience.  So implementing these solutions is best for everyone (except the criminals).

When people think about identity theft protection, they usually are thinking about themselves and their families…not the companies they work for or their customers.  But that is precisely where identity theft protection can be stopped!  Certainly you have purses that are stolen, close friends or family that may do something, but large scale identity theft comes from data breaches of companies.

Criminals target organizations in an effort to get their hands on sensitive data that would allow them to commit identity theft.  A social security number in conjunction with a name or other information.  Perhaps an account number or username.  Bad guys know how to correlate and use this information for malicious purposes.

As a result, it is up to each individual company to protect their customer and employee data.  There are of course several laws and regulations around this sort of thing, but just because a regulation says a company should do something, doesn’t mean that they do.

Data security is so much less expensive than it used to be.  For example, firewall, intrusion detection and prevention, web content filtering, anti-virus, SPAM filtering, virtual private network technology, and more are built into a single device smaller than a book and can offer even the smallest of businesses a great deal of protection.

Your employer could be the one that leaks your private information and causes the theft of your identity.  Ask your employer what measures they have taken to protect your identity.  Encorage them to implement additional solutions, policies, procedures and best practices to keep your data safe.  By doing so, you will be helping out yourself, your family, and many others as well.  Lets raise the water line when it comes to Internet and data security and keep our identities safe.