Slashdot Mirror
Who Wants To Be An Oregonian?
Anonymous Coward writes "TheOregonian.com is reporting that an identity theft ring was caught with ownership of a set of CD's which contained records on every registered driver (~2.5 million people) in the State of Oregon. With all the calls for identity smart cards, federal databases, and better connections among existing state databases, this story should provide a real warning for the abuse such systems invite...by both criminals and the government itself...the records are actually for sale to 'approved' companies like news organizations and banks. The full story can be read here on yahoo as well."
The irony is thick here: Larry Ellison has a summer home in Oregon due to the leanient drivers laws, he has a Oregon driver's license.
...at least I can speculate.
Bringing irony to the Slash-masses
The problem with such a system of course is that the implicit assumption is that the computer is always right. Should someone figure out how to exploit such a system in this way, people will obey the computer without question. And we all know how good the various software companies are at keeping their software free of exploits.
Even with our current social security number system, identity fraud is destroying some peoples' credit ratings, making their lives extremely difficult through no fault of their own. Even if they prove that someone has stolen their identity, sorting out all the dings in the credit record can take years.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
But most of this is probably irrelevant. It's overwhelmingly likely that the records which were stolen were not obtained via sophisticating cracking techniques but were probably swiped by a semi-saavy employee who needs access to the records to do his job. The point is that these systems should be completely closed for maximum security. Even if a maliciously minded employee wanted to do so, he shouldn't be able to walk out with the data on a Zip disk.
Talk all you want about the need for better computer security but to ignore the human side of the equation is to ignore the bulk of the problem.
BEN
According to the original Oregonian article:
In addition to the discs from Oates' apartment, investigators recovered drivers' licenses, credit cards, identification photos, death certificates, Social Security cards and applications for medical residency at OHSU Hospital.
It sounds like there was a lot more to this than just license data. My guess is that it's not the Oregon public that's at risk - it's some OHSU facility this guy was trying to get into.
I have a crappy retail job while I'm going to college and I have access to thousands of people's addresses, credit card numbers, phone numbers, full names, etc. Go to a mall dumpster and you'll find credit card receipts for hundreds of people. The girl ringing up your cargo shorts at Old Navy has access to your information just as easily as these "hackers" and "identity thieves."
Just because there are centralized databases with this stuff now doesn't mean anything, besides people can get 2 million of them at a time. What is someone going to do with 2 million records instead of just 20?
People steal no matter what. Computers don't make that easier or more effective.
One other thing... wasn't Oregon the state that at some point had all of their DOL/DMV info available on the Internet, free-for-all?
:)
Yes indeed. In fact we used it to find out who owned some vehicles that were abandoned on our property once. They took it down fairly quickly, it was only up for a few weeks, I think.
Personally, I hope more things like this happen, it might keep the number of people moving in down a little bit, which would be nice.
Senator Maria Cantwell (Washington) is trying to amend some federal laws for Identity theft. Been on the news almost daily. Seattle Times
Some of the reforms are needed.
Require businesses to turn over to identity-theft victims copies of any records reflecting fraudulent transactions.
Require consumer-credit-reporting agencies to block information that appears on a victim's credit report as a result of identity theft.
Give businesses a new civil avenue to recover damages from identity-theft criminals in federal court.
Change the statute of limitations for identity-theft victims to file a claim from the time when the fraud occurred to the time when the consumer discovers the fraud.
A Roger Zelazny story (One of his more esoteric titles) about a guy who was one of the development team for the national identity database. He left a hole in the system so that he could assume any identity at will and made his living as a sort of glorified private eye.
Well that the story I think of, anyway.
These days, whenever some asshole cuts me off on the road, I'm always tempted to write down the license number and look it up on my DMV CD. It has everything -- SSN, Address, DOB, vehicle information, etc...
Why such a thing was ever published, and why it was decided that the general public should have access to it, I don't know. Don't get the impression that these people acquired this CD through some diabolical means -- in 1997, you could walk right in to the DMV and request a copy. For free, I believe...
A friend of mine bought a used PC for his mother. When he booted the thing up it turned out to have windows already installed. So he clicking around and found a nifty Icon. He clicked on it and wouldn't you know up pops this window which turns out to be a database interface to several thousand Patient profiles for the whole region where he lives. Turns out the Local Health center had sold off some mustered out PC's and forgot flatten the Hard Drives first. That is how easily this happenes.
This sort of thing will allways happen and especially if you hand this sort of information over to private companies. Information will become more easy to access and governments and corporations will abuse it. They regard it as an incontestable right. Just wait till they start putting genetic profiles into these databases and selling them to insurance companies, banks and employers for "Risk Management and Customer/Employee evaluations" Won't it be fun to have your dirty genetic secrets floating around for the public to scrutinize.
Only to idiots, are orders laws.
-- Henning von Tresckow
What they are not telling you is that as of a few years ago ANYONE could order a copy of the entire list of licensed drivers in the state of Oregon. All it cost was sending them a 9-track tape and a small fee. ($75, if I remember correctly.)
It is not until copies of the records started to show up on CDs and on the net that things got changed. (Having someone stalked and killed did not stop them from banning the sale of the lists. Having people be able to look up politician's home addresses did. Kinda sorta.)
Now only people who have a "valid need" for the data can buy it.
The reason they did not ban the outright selling of the license lists was that the direct mail people "heavlly objected".
It became very obvious to those people in Oregon that actually paid attention that the state government cared more about financial concerns than they did about actually protecting public safety and/or privacy.
As for the oregonian... They are known to have a very skewed sense of reporting ethics. I would first determine exactly which axe they have to grind before coming to any conclusions about the "facts" of the matter.
"Trademarks are the heraldry of the new feudalism."
Her measure to Congress is based on a Washington state law that went into effect in July. Under the measure, retailers would have to provide identity theft victims with copies of all fraudulent records, and credit agencies would have to block bad credit information on their reports if they were the result of identity theft.
Why buy someone elses identity? There are plenty of spooky sites around the net which deal with offshore banking, which offer second citizenship or identity cards. Usually in your own name, but also in a name of your choice.
The pricelist includes items like:
- international driving permit: $200
- international student card: $65
- novelty cards (body guard, pilot (!!), delta force, PI etc.): any four, $100
- press card: $2-500
I'm sure there are many more sites like these, (in fact there are). I remember seeing a site once (imsil.com - anyone knows what happened to them?) which offered a new identity for around $6000. It was a passport to some x-UK colony, which didn't (officially) issue passports any more, but the old one were still in use.
-Kraft
Live and let live
Nevada has been doing it for years. I know other states do, California doesnt but I believe some of the eastern seaboard sells the same information.
"Not my manner of thinking but the manner of thinking of others has been the source of my unhappiness." - M
I've lived in Oregon for longer than you have by about 2 years. It is a funny place, but I love it.
Yes, you can't pump your own gas. This is blatantly done to increasing employment opportunities for the uneducated. It seems to work better than just handing people a check. Obviously you haven't quite had the blessing living through a really hard winter yet, or you might be a little less upset about being forced to stay in your warm car.
The "kicker check" is just a hallmark of the right wing tidal wave crashing over the entire U.S. It isn't much different than any other state, and is in some ways better.
Referendums are abused by demogogues, typically "something for nothing" right wing demogogues who pretend that you can just legislate roads, schools, and essential services to cost less than they actually do. It's bizarre how the extreme right in the U.S. in many ways resembles the old time communists; I'm almost expecting to one day hear some radio blowhard to start saying "Get rid of IRS and all taxes, and all services stay same because we then live in socali- I mean, libertarian utopia! Da Da!"
Climatalogically speaking, Oregon is two states. The west west side, and the frozen east side. Studs are essential in the east, and absurd in the west. You legislate a way out of that one.
Portland's urban growth boundary hasn't substantially raised housing prices, despite the propaganda from the builder's associations. It has, however, preserved over 30,000 acres of viable farmland, which employs 50,000 people in the area. It's one thing to sprawl in the desert, quite another to do it over some of the most productive agricultural land in the U.S.
And finally about the Oregonian. Yes, they are a moderate Republican newspaper, but they do report the news - including the topic of this slashdot headline. Identity Theft rings operate all across the U.S. and in other nations, but it was the Oregonian that broke the story about the one our police caught.
I don't call that lousy reporting.