ChoicePoint Data Stolen By Imposters

swight1701 writes "Criminals posing as legitimate businesses have accessed critical personal data stored by ChoicePoint Inc., a firm that maintains databases of background information on virtually every U.S. citizen. The incident involves a wide swath of consumer data, including names, addresses, Social Security numbers, credit reports and other information. ChoicePoint notified between 30,000 and 35,000 consumers in California that their personal data may have been accessed by "unauthorized third parties." No obvious notice appears to be on their website."

Comments

Ineptness to the point of being evil

[Eric Smith]

The MSNBC article quotes the consumer notification:

You should continue to check your credit reports frequently for the next year.

If I get the notification, I'm going to request that ChoicePoint pay the costs for me to subscribe to unlimited credit report access from all three credit bureaus. IIRC, that costs about $100/year for each bureau. Since it's ChoicePoint's screwup, I shouldn't have to pay the costs necessary for early detection of fraud in my credit report.

The article further quotes ChoicePoint spokesman Chuck Jones:

But ChoicePoint has no way of knowing whether anyone's personal information actually has been accessed

Why the hell are they allowed to keep a dossier on me if they don't have any mechanism in place to allow them to track how it is used and by whom? This is insane!

The correct solution to this problem, IMNSHO, is for the courts to determine that personal, financial, and credit records relating to an individual are the COPYRIGHTED PROPERTY OF THAT INDIVIDUAL, and may not be provided to any other party without the owner's explicit consent. Not a blanket consent to provide the data to anyone inquiring, but specific consent to provide it to XYZ Corporation.

Re:Ineptness to the point of being evil

[bryce1012]

The problem with that approach, of course, is that it requires the granting of "copyright" and the associated powers to individuals, and not the ??AA. Or other money-grubbing corporations. Who's gonna support that?

Re:Ineptness to the point of being evil

[shanen]

Very insightful, and I agree that we need a legal principle that personal information belongs to the individual--but I think we should go farther. I think we should require that the personally-identifiable personal information only be stored on the computer of the person who owns it--and that the authorities need to show probable cause and get a search warrant before they have any acces to it. However, a lot of it should be covered under the Fifth Amendment, too.

Probably won't happen, however. In fact, we are going in the other direction and the companies that hold your data legally "own" it in most cases.

By the way, don't you recognize this particular company? Same one that helped BushCo purge all those voters in 2000. I think they got out of the voter purging business before 2004, but I haven't really been tracking it.

Re:Ineptness to the point of being evil

[LostCluster]

The correct solution to this problem, IMNSHO, is for the courts to determine that personal, financial, and credit records relating to an individual are the COPYRIGHTED PROPERTY OF THAT INDIVIDUAL, and may not be provided to any other party without the owner's explicit consent. Not a blanket consent to provide the data to anyone inquiring, but specific consent to provide it to XYZ Corporation.

Courts aren't going to help you with that at all. The copyright on information belongs to the writer, not the subject of the piece. Just think what your copyright concept would do to the news media...

Re:Ineptness to the point of being evil

[Anonymous Coward]

Welcome to the future. Better get used to it.

O'Harrow explores how the government is teaming up with private companies to collect massive amounts of data on citizens and how, he writes, "More than ever before, the details about our lives are no longer our own. They belong to the companies that collect them, and the government agencies that buy or demand them in the name of keeping us safe."

No Place to Hide: Behind the Scenes of Our Emerging Surveillance Society

Re:Ineptness to the point of being evil

[Anonymous Coward]

No, legislation is the solution, not the courts. And if personal info were copyrighted we would have all sorts of BS like England does where celebrities can sue for being called whiny in print. What we need is a happy medium, the details of which should be worked out by somebody less tired than me.

Re:Ineptness to the point of being evil

[Eric Smith]

You're right that legislation would probably be needed to grant ownership of the data to the subject.

And if personal info were copyrighted we would have all sorts of BS like England does where celebrities can sue for being called whiny in print.

I don't think so. "Whiny" is a subjective description, not factual information about a person, and even if there was an objective standard for it, as soon as the person said one whiny thing in a public place, it would no longer be private data.

Re:Ineptness to the point of being evil

[eh2o]

oh, *that* choicepoint... well at least we know that the data stolen was 99% inaccurate. right?

Re:Ineptness to the point of being evil

[yog]

This is really scary.

The thing that bothers me is that some data is unchangeable, e.g. US social security #, date of birth, and mother's maiden name. Once it's out there, you're screwed.

Once someone has this data they can really do a number on you because that's all most commercial sites seem to require in terms of validation. They can take out credit cards in your name, perhaps even access your bank account if they have access to your checking account number.

I think that eventually, and unfortunately, there's gonna have to be a law. No organization except the social security administration should be allowed to store our SS #, for example. Heck, at the rate things are going, they may have to start allowing people to change their SS # to start fresh.

A friend never allows her SS # to be used for anything. Not banks, not schools, not health insurance. They squawk and scream and threaten and she stands firm. No, she says, you can't have it. It's only for her retirement, not for generic identification purposes. So far she has successfully evaded spreading her most precious identifying information all over the internet in god knows how many incompetently coded and poorly safeguarded databases. Massachusetts also allows one to use a generated code instead of SS # on drivers licenses.

This thing is really out of hand. Of course, it's going to cost credit card companies millions of dollars when bogus bills start bouncing, and that's probably when the powers that be finally wake up and address the problem.

Re:Ineptness to the point of being evil

[eh2o]

according to a new federal law, The Fair and Accurate Credit Transactions Act (passed in Dec 2003) you are entitled to a free comprehensive credit report yearly. The big three have an official website at www.annualcreditreport.com (no link b/c they reject unofficial referals) where you can claim your report. (though its not available yet for the mid and eastern states, it will be by the end of 2005).

Re:Ineptness to the point of being evil

[Eric Smith]

Yes, and that is a good thing. But one free credit report from each agency is an inadequate remedy for a lapse like this, which is why I would demand that ChoicePoint buy me a subscription.

As of Saturday afternoon, I had not received any notification from ChoicePoint. I'll watch my mailbox.

Re:Ineptness to the point of being evil

[miu]

This thing is really out of hand. Of course, it's going to cost credit card companies millions of dollars when bogus bills start bouncing, and that's probably when the powers that be finally wake up and address the problem.

Fraud is a cost of business to credit card companies, the only way that the credit card companies would actually pay the price here would be if people actually stopped using them. Short of that drastic and unlikely occurrence any level of theft and fraud will be absorbed and paid by the customer.

Re:Ineptness to the point of being evil

[Anonymous Coward]

Although "not allowed" you can quite easily get around it. Just use an address west of the Mississippi, and when they ask for any recent addresses, give 'em where you live now.

Works like a charm.

-- ac

Re:Ineptness to the point of being evil

[Riddlefox]

Very insightful, and I agree that we need a legal principle that personal information belongs to the individual--but I think we should go farther. I think we should require that the personally-identifiable personal information only be stored on the computer of the person who owns it--and that the authorities need to show probable cause and get a search warrant before they have any acces to it. However, a lot of it should be covered under the Fifth Amendment, too.

Just out of curiousity, how do you propose that I store personally identifiable information such as my name and address on a computer owned by me when I wish to make a purchase online? How can I have my paycheck electronically deposited into my banking account if my employer can't store my personal information? How is H&R Block going to prepare my taxes for me if they can't enter any of my information on a computer that I don't own? Am I going to have to tell Netflix my name and address and credit card info every single time I want another movie?

Re:Ineptness to the point of being evil

[damiangerous]

A friend never allows her SS # to be used for anything. Not banks, not schools, not health insurance.

Banks require your social security number for tax reporting purposes. It's a Federal law (you get that 1099-INT each each with interest bearing accounts, for example), as the IRS has a vested interest in your finances. You cannot "opt out", any more than you could opt out of giving your employer your SS#.

Re:Ineptness to the point of being evil

[mingot]

By the way, don't you recognize this particular company? Same one that helped BushCo purge all those voters in 2000. I think they got out of the voter purging business before 2004, but I haven't really been tracking it.

Off topic, really, but I have to vent. They screwed my wife out of a job this year. We were recently married and they failed her background check on her name on file with the credit bureaus not matching the name on her application. They also dragged ass fixing the problem and had a policy in place to NOT notify they potential employer that they had made a mistake.

Re:Ineptness to the point of being evil

[Anonymous Coward]

No, the solution is a law that says your SSN can not be used for authentication. If SSN numbers were only used for identification this would not be a problem, but too many places use your SSN as a secret password when it is no more secret than your name.

Re:Ineptness to the point of being evil

[Anonymous Coward]

You are not required to have an SSN. Yes you can opt out, it's just that they have made it incredibly difficult to do so.

Re:Ineptness to the point of being evil

[Kenrod]

The solution is for the government to create a Commision with real power (like the SEC) to police these guys and fine/imprison those found negligent. The information industry has become too critical to be allowed to betray the public trust without serious repercussions. These bastards have had a free ride up to now (ChoicePoint's web page says "ChoicePoint® Reports Record Revenue, EPS").

We need a full investigation. ChoicePoint's liability could be enormous. It is clear a cover-up may be going on.

It's time to Arthur Andersen these bastards out of business.

Re:Ineptness to the point of being evil

[yog]

Banks require your social security number for tax reporting purposes.

You have a point there and I am not sure how she deals with banks; maybe she keeps all her money in Canadian banks.

Also, there are lots of foreign people in the U.S. and elsewhere who have U.S. bank accounts but no SS #. I suspect that banks assign these people arbitrary generated numbers. Perhaps you can go to a bank, tell them you're from Scotland or Uruguay or the South Pole and just open an account without the damn SS number. Of course they may demand a passport.

Now here's an interesting bit of trivia. You can change your social security number. It's free and you have to apply, with proof of identity, and also supply a reason why the change is needed. It can be a change of name, threat of domestic violence, identity theft, or even because the numbers are offensive to your religious beliefs. I suppose the latter reason is the best way to change your SS # arbitrarily. However, they say they keep your old number on file and cross referenced, so it may be that someone with your old number could still cause you grief.

Re:Ineptness to the point of being evil

[aprilsound]

Can't anyone see a down side to making your "personal" information your property? Say goodbye to phonebooks and directory assistance. What about arrest records? Will it be illegal for me to know if the guy down the street is a sex offender?
Consider the first amendment issues as well, what if I want to post a list of congressmen's addresses, in an effort to encourage letter writting campaigns (as some have proposed in comments)? Is it illegal for me to reveal that personal information? If I can say someone's phone number or address, can't I also print it? If it's in print, then it will end up in a database.

Ever think about what happens whenever are asked to "verify" your personal information. You give them the last four digits of your SSN. THEY ALWAYS ASK FOR THE LAST FOUR DIGITS!
All I have to do is call you up, say I'm with Visa (because everyone has one) and I need to verify some information, I ask for the last four of your SSN... BAM! I've got you. I can now call almost any financial institution, and do just about whatever I want.

The problem isn't that people are gathering my personal information, it's in the public domain, if I stop them I'll kill our freedoms, it's that bad people know that it takes very little to completly own my life.

Re:Ineptness to the point of being evil

[damiangerous]

You cannot "opt out" of a Taxpayer Indentification number if you have any dealing with the IRS (who must file). If you are eligible for a Social Security Number, it must be that. You can only get an ITIN or ATIN in a few limited situations (usually foreigners). So while it is technically true that some people may not be required to have an SSN, you would pretty much have to be a non-dependent (since you need an SSN for others to claim you) living at home and making very little money, or a homeless difter.

Re:Ineptness to the point of being evil

[TheOriginalRevdoc]

I think you're picking up the wrong end of the problem here.

It's not that these data should be legally kept private to prevent fraud, though there's an argument that they should on privacy grounds.

Rather, it's the fact that the US financial system is so lax on security in general. Australia is a good example of how this sort of thing is handled elsewhere. If you want a credit card or bank account, you need to provide 100 points of identification, which can be made up of a variety of ID items. Here's an example:

http://www.national.com.au/Business_Solutions/0,,4 9834,00.html

It's not a foolproof system, but it means that identity theft happens a lot less often in Australia than it does in the US.

Re:Ineptness to the point of being evil

[Jah-Wren Ryel]

Courts aren't going to help you with that at all. The copyright on information belongs to the writer, not the subject of the piece. Just think what your copyright concept would do to the news media...

It isn't nearly as simple as that.

Photographers require a release from models they shoot, similarly with tv shows (watch any of those reality shows and you'll occasionally see people who were filmed but would not sign a release, their faces and any other personally identifiable information is blurred out). So while copyright in the photo or film is owned by the shooter, I believe that it is considered a derivative of the subjects themselves. There could easily be a specific section of the copyright code that deals with this as a special case, I just don't recall any.

So, I think it is reasonable to consider personal records as a rough equivalent of a photograph of that person as they certainly are derived from the actual personal details that in part make up that person. (Then we get into the sticky territory of copyrighting facts.)

Re:Ineptness to the point of being evil

[Sax Maniac]

I do, too... but banks are one of the few that legitimately do need your SS. They pay interest and will send you a 1099 at the end of the year. If you have a mortgage, then you really want them submitting a 1098, otherwise you are begging for problems with what is mostly likely your single largest tax deduction (mortgage interest). Like it or not, your SS is your tax ID, and you need for tax transactions.

But your health insurance, definitely. I went through this pain about 5 years ago when I refused to hand it out to the insurance droids. They almost blew a fuse, but by a miracle, it actually worked. Fast forward to now, and they send me a helpful letter telling me they're changing my insurance ID to something that's not my SS#, to prevent fraud. Thanks, but you already don't have it.

The only problem is many places want to use it for credit checks, and they'll refuse to sell you some service if you refused. I remember the last time I bought a cell phone I had to, because I didn't feel like paying a few hundred dollars for a "security deposit".

Re:Ineptness to the point of being evil

[Anonymous Coward]

This sounds like one time when I would actually agree with 'sueing the bastards'. Surely there's something you can do in a case like that?

Re:Ineptness to the point of being evil

[lordkuri]

Fraud is a cost of business to credit card companies

as a holder of a merchant account, I can say that you're full of shit. WE bear the brunt of fraud (a.k.a. "Chargebacks")... not only do we lose the money, but we get charged a nice little fee along with it. (usually around $30-40).

oh yeah, and get more than $x percent chargebacks in a year, your account goes *poof*

Re:Ineptness to the point of being evil

[Anubis350]

unless it's american express, AFAIK (and correct if I'm wrong) but amex gaurantees payment

Re:Ineptness to the point of being evil

[miu]

I didn't say that the CC companies bore the cost, I said that they view it as a cost of business - with the customer ultimately paying the cost of fraud.

Re:Ineptness to the point of being evil

[jonwil]

I aggree here.
I have recieved physical mail addressed to me in the past from American Express asking if I wanted an American Express card (I dont) and I have never had any dealings with American Express.
So they got my details because some other company gave it to them.
It should be illegal for comapnies to do that.

Also, any company with your details should be required to let you change it (e.g. if you move house, you can have your details changed)
And more should be done so that mistakes and identity theft cant have negative effects (e.g. if someone is able to steal your ID and ruin your credit rating you should be able to get that black mark removed if you can prove that your ID was stolen and that you didnt do whatever it was that ruined the credit rating)

Re:Ineptness to the point of being evil

[dnoyeb]

Nope, we don't need that at all. All we need is to say that collectors of information are liable for whatever results from the use of the information they collected. And make it statutory.

Re:Ineptness to the point of being evil

[damiangerous]

Also, there are lots of foreign people in the U.S. and elsewhere who have U.S. bank accounts but no SS #. I suspect that banks assign these people arbitrary generated numbers.

The IRS is way ahead of you, that's what ITINs and ATINs are for.

Re:Ineptness to the point of being evil

[the_Bionic_lemming]

Nope, we don't need that at all. All we need is to say that collectors of information are liable for whatever results from the use of the information they collected. And make it statutory.
Take it three steps further - Outlaw Insurance on liability claims against the folks collecting information and shut them down if they don't pay.

Third Step? Allow the government to seize all profits from the individuals that got nailed by the law until the damages are paid off.

Re:Ineptness to the point of being evil

[Bastian]

and you, the merchant, are forced to cover costs by passing it on to customers.

I don't think there's any coincidence that my local coffee shop raised all their prices about the same time they started accepting credit cards, and I appreciate that my favorite local CD store charges a buck fifty per CD extra if you pay with credit cards - that way, I don't have to subsidize other peoples' credit card use when I pay cash.

That said, with the way retailers have to bear the brunt of the damage when someone commits credit card fraud, I am absolutely amazed that almost no stores have a policy of requiring a picture ID with a credit card. If I ran a store, cashiers would get fired for not carding people who want to buy things with credit cards.

Re:Ineptness to the point of being evil

[SillyNickName4me]

> is that it requires the granting of "copyright" and the associated powers to individuals, and not the ??AA. Or other money-grubbing corporations. Who's gonna support that?

Since quite some time every individual in the USA will get automatic copyright on their creations, ??AA or not.

The issue here is that it would require asignment of copyright on what is merely a collection of information information instead of a creation.

Re:Ineptness to the point of being evil

[Anonymous Coward]

No, it does not have to be an SSN just because you are eligible for one. It (in practice anyway) has to be an SSN if you *have* one, but if you don't you can almost always use a Tax ID. You do have to apply for that one, however.

There are a lot of websites about living without an SSN (or just without revealing yours), and while it isn't easy, it isn't impossible either. Frankly, you don't need banks anymore these days. It may have its problems, but PayPal makes a very decent bank if you are forced to use it as such. The real problem is with employment: it can be very hard to get some jobs without an SSN.

Living off the grid, however, is a real option if you aren't using a bank account. If you do local work for cash and freelance work online (less than $600 per employer per year), you already have a 25%-30% head start over everyone else, who pays 15.3% in SS/Medicare and 10%-15% in income taxes. That means you can work 3/4 as hard as everyone else and enjoy the same lifestyle, all while doing less paperwork. Not everyone's cup of tea, but the chances of ever having a problem with the IRS are nil. They would far rather nail people that are on the grid AND not paying taxes, because it's a heck of a lot easier. Plus, they tend to know beforehand how much $$ they can recover.

Re:Ineptness to the point of being evil

[shanen]

Actually, in theory there is no reason for the bank to know anything about you, even including your name or address. I'll construct a simple concrete scenario around your example of an online purchase:

1. Go to Web site and log in (or otherwise establish your identity--I actually think a secure system should really have at least two security elements of something you have and something you know, but this is getting off the topic here).
2. Select the merchandise and order it.
3. The store contacts your computer for payment information.
4. Your computer asks for confirmation that you made the order.
5. After confirmation, your computer returns a bank number, an account number, and an authorization to withdraw some money.
6. The store contacts the bank and asks for money.
7. For extra security, the bank might double-check with your computer again. (Just an example of what should be user-controllable security settings that could be included in the certificate. If you were really paranoid, you might insist that the bank doublechecks directly with you, especially for larger purchases, but in that case the certificate would also need to include some personal information about you and how to contact you. Your decision whether or not to do that, however.)
8. Money is transferred to the store.
9. The store contacts your computer again, confirms payment and asks for the shipment information.
10. Merchandise is shipped.

There is no intrinsic requirement here for the bank to know more than the source and destination account numbers and how to examine the certificate for authenticity. The bank has no reason to know how much money you have in other banks, or anything beyond the fact that this account number has enough money to cover the requested transfer. (Your other example is almost exactly the same, but with the transfer coming from your employer to an account you have specified.)

Re:Ineptness to the point of being evil

[tommyth]

There's a problem with that line of thinking (not ever giving out a SSN). There are other laws that require her SSN. For example, if she were to be working with radioactive materials, at say, a college in MA, if she refused to give her SSN, she would not be allowed to use radio active materials. It has nothing to do with security, but a persons SSN is just about the only number that tracks a person for life. And in the case of the radioactive stuff, we're required to keep her radiation exposure record for XX years even if she leaves, and the only way to reference it is by SSN (because any proprietary number we give her know, like a school ID#, doesn't mean anything to any other organization).

Re:Ineptness to the point of being evil

[SillyNickName4me]

> Can't anyone see a down side to making your "personal" information your property? Say goodbye to phonebooks and directory assistance.

Eh? so, I give permission to publish my name and number if I want to be found, and if not then I cant be found. I really fail to see any problem here whatsoever.

> What about arrest records? Will it be illegal for me to know if the guy down the street is a sex offender?

The flipside of that is that such knowledge actually gives people very little choice other then contibuig beign criminal after punnishment. Why? because they have no fucking chance to build a normal life if everyone will turn them down based on such information. From an individual point of view I understand your comment, but for society as a whole it might actually be better if such information was not public.

Re:Ineptness to the point of being evil

[rosie_bhjp]

To be fair, it is possible to obtain a new SSN. They don't like to, but enough bitching can get it done. Link Here
I can attest that this works but it is also a pain in the ass because sooooo many places tie you to your ssn.

Re:Ineptness to the point of being evil

[cyberfunk2]

You should be careful about wanting all information about you to be copyrighted. I think there are lots of legitamite uses to store people's names and phone numbers and potentially other pieces of information.

I mean, take for example, the following hypothetical situation. You meet someone at a conference, you put down their contact info in your palm pilot so you can talk buisness/collaborate/etc at some later time. You've just violated copyright law? What you say ? they gave you permission. Well that's all well and good, but what if they didnt ? What if you just happened to somehow get hold of a buisness card of a speaker without actually meeting them ?

I mean, this sort of thing could kill interpersonal communication for fear of someone suing you just for saying hi. Hell, some people might just make a buisness out of it. And dont say that's silly, witness the slimebag that is SCO.

Re:Ineptness to the point of being evil

[HyperCash]

I think so. If they said something that wasn't true to a potential employer I'd say thats a defamation or libel suit right there.

--HC

Re:Ineptness to the point of being evil

[null etc.]

The thing that bothers me is that some data is unchangeable, e.g. US social security #, date of birth, and mother's maiden name. Once it's out there, you're screwed.

That's the great thing about this country, if you ask me.

We can enter into binding agreements by doing nothing more than provide a signature. We can call over the telephone and enact transactions that have major financial ramifications, just by providing some information that nosy snoopers wouldn't have much trouble finding. And we can use our Social Security Number, whose purpose was never intended to be a unique tracking number.

The truth is, any private investigator has enough tools at their disposal to easily commit identity theft. How long do you think thieves will take to catch up?

It still amazes me that all sorts of transactions can be concluded without biometric verification. My friend got majorly screwed by his family because his father had the same name. You should see how badly mangled his credit history, tax records, health records, and financial transactions are.

Re:Ineptness to the point of being evil

[Anonymous Coward]

By writer you mean creator I suppose (you don't write a painting or a sculpture). The question is why should I not be able to control what is being done with my personal information? After all, my personal information is unique to me, and I have made a considerable contribution at making that information the way it is (I have my current salary because of decisions I made. I paid some bills late because of a decision I made (or not). You get the idea.)

The mere action of converting the information in a written form does not warrant the converter the right to use it in whatever way he/she may like. Just because I write down the words I heard in an interview on TV does not mean I have the rights to publish that as my own creation, even though, by all practical means, mine may be the only written record of it.

But this isn't the problem really. The fundamental problem is that certain types of information can be used to commit criminal acts, producing significant damage to the subject of the information. The legal responsibility in the event of such a criminal act occuring because the information was used improperly is a tricky matter. In the case of credit cards, competition pushed card companies to offer protection features, that do not hold you (the account holder) financially resposible for things you didn't buy.

In the case of the credit-report agencies on the other hand, there is no competition. You don't get to choose which credit-report company to use. In this case it should be that either: 1) Such credit-report companies cannot use your information unless expressly permitted to by you (this will encourage competition) 2) They are being held legally responsible for any misuse of the information.

Both cases require legal support, so maybe before passing another one of those "Patriotic" laws, Congress may look into this. But then I'm a dreamer...

Re:Ineptness to the point of being evil

[shanen]

Given that the cost of copying information is approaching quite close to zero, how do you propose to enforce that liability? Copying it back and forth, it will be impossible to know who is liable for anything, no matter what the statutes say.

We really need to start by saying that there is no god-given (or Constitutional or what-have-you) right to have our personal information, or the cat is already out of the bag and off to the races, leaving a trail of decanned worms everywhere.

(Yes, it's actually a serious topic, but my atomic metaphor mixer got out of control.)

Re:Ineptness to the point of being evil

[Fulcrum of Evil]

I mean, take for example, the following hypothetical situation. You meet someone at a conference, you put down their contact info in your palm pilot so you can talk buisness/collaborate/etc at some later time. You've just violated copyright law? What you say ? they gave you permission. Well that's all well and good, but what if they didnt ? What if you just happened to somehow get hold of a buisness card of a speaker without actually meeting them ?

Well, you can't copyright facts, so your situation is totally safe.

Re:Ineptness to the point of being evil

[Eric Smith]

Say goodbye to phonebooks and directory assistance.

Phone books and directory assistance already only list people who are willing to be listed, so how is this a problem?

Will it be illegal for me to know if the guy down the street is a sex offender?

No, because the conviction is a matter of public record, so the government would still be able to include it in a publicly-accessible database

what if I want to post a list of congressmen's addresses, in an effort to encourage letter writting campaigns

You'll still be able to post a list of their public mailing addresses. You won't be able to post a list of their home addresses, unless that information isn't private, but there are already legal problems today with publishing government employee's home addresses so that wouldn't really change much.

If I can say someone's phone number or address, can't I also print it?

The proposal wouldn't have any different effect on audible speech vs. written.

If you're going to object to the proposal on the basis of examples, at least please try to make them more than just strawmen.

Re:Ineptness to the point of being evil

[Eric Smith]

What if you just happened to somehow get hold of a buisness card of a speaker without actually meeting them ?

If they've printed their address on business cards to hand out, the information is no longer private, so it wouldn't be covered by the proposal.

Re:Ineptness to the point of being evil

[SeaFox]

If I get the notification, I'm going to request that ChoicePoint pay the costs for me to subscribe to unlimited credit report access from all three credit bureaus. IIRC, that costs about $100/year for each bureau. Since it's ChoicePoint's screwup, I shouldn't have to pay the costs necessary for early detection of fraud in my credit report.

Don't forget. Once the Fair and Accurate Credit Transactions Act takes effect (it's being phased in over the next few months) you'll be able to get a free credit report once a year. Since there are three agencies, I don't know if that's one from any of the three, or one from each per year. You may be able to stagger the reports you get so you recieve one per quarter, only having to pay for the fourth report.

Re:Ineptness to the point of being evil

[dgatwood]

Just so long as there are severe civil and criminal penalties for phone companies that charge money to keep your phone number private.... The very thought of having to pay money for your number not to be published is downright disgusting.

Re:Ineptness to the point of being evil

[Anonymous Coward]

Well, to play the devil's advocate, she should have told her potential employer that she was recently married and given her maiden name to the company as well. Not just for the background check, but had they called any of her references using her married name, those companies would likely not all have known her married name.

Now if she did provide her maiden name and the company still failed her background check solely due to the legal name change, that could be considered incompetence. But if she didn't, there's probably not a legal leg to stand on if you tried to sue as the other reply indicated.

Re:Ineptness to the point of being evil

[Anonymous Coward]

so to get 110 points all you need is a birth cert or passport, and a drivers liscense... sounds just like the states to me...

Re:Ineptness to the point of being evil

[SillyNickName4me]

Yeah, I completely agree (but then, I think they should keep it private unless you give explicit permission to publish it anyway)

Re:Ineptness to the point of being evil

[karakal]

You live in America. In Europe there are very hard and consequent laws for the security of personal data. And we are all doing very very fine...

Re:Ineptness to the point of being evil

[nametaken]

Hate to do this since you're already angry about them, but...

The most recent news on their website doesn't say anything about the breakin. It says only this:

"01/26/2005 ChoicePoint® Reports Record Annual Revenue and Earnings per Share"

Hopefully that will change.

Re:Ineptness to the point of being evil

[DrSkwid]

> Merchandise is shipped.

where to? no-one knows your address

Re:Ineptness to the point of being evil

[jasgo]

Australia is a good example of how this sort of thing is handled elsewhere. If you want a credit card or bank account, you need to provide 100 points of identification

I didn't need to when I applied online for a credit card with my bank. Although, I was a current customer so I'm not sure if that made a difference (didn't seem to based on the pages I filled in).

Re:Ineptness to the point of being evil

[packeteer]

The question is why should I not be able to control what is being done with my personal information?

You dont get to choose what people do with a picture they take of you. They can do almost anything they want with it as long as they didn;t break into your house to take the picture.

Re:Ineptness to the point of being evil

[shanen]

Hey, I understand about forgetting to read the article (though this one was worth the reading), but if you're going to reply to a specific post, at least you ought to read that. Specifically Step 9 of the little example.

However, that doesn't mean it needs to be your real address if you don't want to reveal that. Do they still do General Delivery?

Re:Ineptness to the point of being evil

[DrSkwid]

> personally-identifiable personal information only be stored on the computer of the person who owns it

I repeat : how do they store the shipping address ?

Re:Ineptness to the point of being evil

[_randy_64]

If you live "in the western states", and sometime this year for the rest of us in the USA, you can get your credit info for free. You can also get info on your medical, insurance, tenant, and hiring histories from the links here. That link comes from TFA. It will take some time to track down everything, but it's easier now than it used to be, and everyone in the USA should do it!

Re:Ineptness to the point of being evil

[Anonymous Coward]

Yeah, thanks, Euro-boy, but no one cares.

Re:Ineptness to the point of being evil

[xami]

A friend never allows her SS # to be used for anything. Not banks, not schools, not health insurance. They squawk and scream and threaten and she stands firm. No, she says, you can't have it. It's only for her retirement, not for generic identification purposes.

I never really understood this, why is the SS# used so widely in the USA? I've visited a lot of countries in my young life and almost every one of them had some kind of ID card - for identification only that is. Is it due to the different laws in different states or what?

Re:Ineptness to the point of being evil

[Anonymous Coward]

I repeat on GP behalf: You tell them where to ship.

They don't need to keep it stored with anything other than the order processed.

Re:Ineptness to the point of being evil

[Anonymous Coward]

First day of copyright class- you can not copy right facts or functional aspects of info organization. That is the say legal reasoning that allows for Reverse engineering in general.

Re:Ineptness to the point of being evil

[dr_dank]

We were recently married and they failed her background check on her name on file with the credit bureaus not matching the name on her application. They also dragged ass fixing the problem and had a policy in place to NOT notify they potential employer that they had made a mistake.

Sorry that it didn't turn out in your wifes favor, but how is this a mistake? If Choicepoint is told to look at records under a certain name, how would they know to look under a different name for your wife if the prospective employer didn't tell them to?

Re:Ineptness to the point of being evil

[korbin_dallas]

Thats BS! I have HAD to do this. We got 1 free, the other 2 we had to pay for anyway.

The only reason there isn't a wicked ass law on this, is that the consumers are paying for it. Please do not delude yourselves by saying the corps(e) are footing the bill.

I say lets gets the vulture lawyers on this, file a class action against the the company to provide free subscriptions to all listed.

Re:Ineptness to the point of being evil

[Tangurena]

This will happen with the new US National ID card system. To verify the validity of each card will require connection to some huge national database. It won't be long before organized crime starts accessing the system to decide who to rob and whose identity is worth stealing. The same with the RFID scheme for US passports: read the passport, run their credit report, and if they are worth bug bucks, kidnap them as they leave the baggage claim area. After all, the smart passports will even have a digital picture to make kidnapping easier.

The Europeans have the correct model for data privacy: the data is the property of the person the data is about. The US model: that data is the property of the owner of the database, is what leads to identity theft and massive credit card fraud.

Identity Theft, and Identity Fraud crimes will only get worse because our underlying assumptions and expectations about data privacy and security are defective. Trying to stop those crimes by making the penalties for Identity Theft and Identity Fraud harsher is like trying to turn a sawhorse into a racehorse by painting it more.

The parent poster is correct. We cannot mitigate or minimize risks to ourselves when someone else refuses to be responsible for data about us. If the credit bureaus end up going out of business rather than correcting the defects in their business model/industry, fine, they deserve to die. Good riddance to them.

Re:Ineptness to the point of being evil

[Anonymous Coward]

> Just think what your copyright concept would do to the news media...

I don't support this kind of arguement, but....

a) could it be that much worse?
b) would anyone notice?
c) who would care?

Face it, most of what passes for news these days, isn't much more than PR pieces anyways.

Re:Ineptness to the point of being evil

[abb3w]

A friend never allows her SS # to be used for anything. Not banks, not schools, not health insurance.[...] It's only for her retirement, not for generic identification purposes.

Schools and health insurance makes sense. However, if you have an interest-bearing account, I was under the impression that banks do have statutory authority to get your SS# to report the interest income to the IRS. The only way I can think of around this is incorporation (perhaps of a trust? IANAL...) -- thus getting a separate corporate TIN.

How did she get the banks to STFU?

Re:Ineptness to the point of being evil

[EvilTwinSkippy]

Amen to that.

A company that does background checks lets hucksters through? And when the matter is discovered, they only notify the people affected when forced to by law. Credibility, meet Mr. Dumpster.

Re:Ineptness to the point of being evil

[Anonymous Coward]

Under your scheme as soon as someone accesses the data and displays it on their (other) machine, the law has been broken.

Computers need to cache data locally so that they can display it.

If data is only allowed to be on one machine then no one else can ever use it for anything.

Re:Ineptness to the point of being evil

[Anonymous Coward]

Showed them her tits.

Re:Ineptness to the point of being evil

[ExistentialEngineer]

Could I trademark my name and thus own it?

Re:Ineptness to the point of being evil

[timeOday]

Courts aren't going to help you with that at all. The copyright on information belongs to the writer, not the subject of the piece. Just think what your copyright concept would do to the news media...

Oh really? Does that mean I can photograph Coke's trademarks and print them on my own products? Or does Coke in fact "own" that information? If a Coke employee discloses private business information, Coke can sue them to obvlivion, if not send them to jail. If Coke can own its information, why can't I?

Re:Ineptness to the point of being evil

[number11]

they failed her background check on her name on file with the credit bureaus not matching the name on her application. They also dragged ass fixing the problem

What we need is to hold companies (credit bureaus) that sell personal information legally responsible for both real and consequential damages in the event that the information is untrue, erroneous, or improperly used. No excuses about ineptness. They could protect themselves in the first two cases by requiring that the people they get information from guarantee its accuracy. The credit bureau could protect themselves in the last case by requiring that the people they sell information to guarantee it will not be misused.

But the victim needs a clear party to hold responsible, and the middleman who's making money selling the information is the obvious choice.

Re:Ineptness to the point of being evil

[panda]

I think that eventually, and unfortunately, there's gonna have to be a law. No organization except the social security administration should be allowed to store our SS #, for example

Actually, that used to be the law in the U.S., but the regulations have been relaxed. I refuse to do business with companies that ask for my SS# when they don't need it. If I tell them they can't have it and they insist, then I tell them that they won't get my business.

Re:Ineptness to the point of being evil

[willwarner]

"ChoicePoint has no way of knowing whether anyone's personal information actually has been accessed"

In the absence of legislation, paying Watchers get privacy protections, and deadbeat Watchees like you and me don't. Want to spy on an ex-girlfriend? Fork over the cash and you're golden. Want to know who's been spying on you? No can do.

This is alarming, although it's hard to formulate a good fix. "All" personal data being copyrighted is absurd, since this data is vitally important to criminal trials and investigative journalism, to toss out a couple of public-interest examples that spring to mind immediately.

Instead, how about:
(1) Data concerning transactions between parties (ie J Smith and VISA, or Smith and an insurance company) must be provided free to these parties.
(2) Database sellers like VISA or ChoicePoint must prove or delete challenged records.

So ChoicePoint can still buy info from VISA and sell to Smith's prospective employer, but Smith can check it, and correct it.

There will need to be strict time limits and heavy fines on both of these rules, so ChoicePoint doesn't drag its feet.

The FACT Act and annualcreditreport.com are an EXCELLENT start, and ChoicePoint's site has similar options. They couldn't verify my identity and send me my report online, but in fairness I'm a college student who's used 8 addresses in the last 8 years (3 parent homes, 1 parent PO Box, 4 dorm & apartment addresses). ACR.com will become available to Texas on June 1, and then I plan to use it and see what ChoicePoint has on me while I'm at it, probably using the 1-800 number instead of just the web.

Or there's the non-legal solution: both VISA and Smith keep receipts of each transaction, including "total balance" and "credit rating" and so forth. Then Smith can prove to his prospective employer that ChoicePoint is wrong. Receipts could use public-key encryption, and be electronic.

Re:Ineptness to the point of being evil

[Eric Smith]

"All" personal data being copyrighted is absurd, since this data is vitally important to criminal trials

Having personal data be copyrighted (or otherwise owned by the subject and not normally distributable without his or her consent) would do NOTHING to criminal trials. A court order or subpoena would still get the data, though possibly under seal.

and investigative journalism,

Why should a journalist (of any sort) have any right to collect private data on me? Even today, I don't think they have any right to get a credit report on me without my consent, though it probably happens since there's such lax checking for authorized use (which is of course the whole point of this thread).

Re:Ineptness to the point of being evil

[Jumper99]

Same one that helped BushCo purge all those voters in 2000

IIRC, the purge was done at the request of a Democrat after a particularly nasty mayoral election. So do you mean to say that two democrats were paid off by Bush to demand a purge that would help Bush in a later election? My God man, break out your tinfoil hat!!!!

Re:Ineptness to the point of being evil

[Anonymous Coward]

That's the wrong kind of "well endowed" to show a banker to wake them up.

Re:Ineptness to the point of being evil

[Anonymous Coward]

About a couple of years ago, you probably received notices from every company under the sun stating their 1 page privacy policy. This is due to the only honest legislation to come from our government since the depression Sarbanes-Oxley Act of 2002. It requires companies to give you a change to opt out if you notify them.
You must either call or write every single company you have ever dealt with and state that you wish to be removed from any marketing scams( sorry plans) or anything else without your express consent. Start with every credit card you currently own, work down to those you cancelled in college. Work through every bank, saving and loan, mortgage company for the last 75 years or so, and then your hospitals, dental, medical offices, grocery store, insurance company, etc. You can do it. It just is very time consuming.

Also call Choicepoint at 1-888-203-7969 and ask to opt out as well.

Re:Ineptness to the point of being evil

[TheOriginalRevdoc]

Nope.

In the USA, opening a bank account generally only requires SSN, photo ID, and proof of age. So you can front up to the bank with a driver's license and a phone bill, assuming that the former has your DOB and signature on it.

This is far from the equivalent Australian requirement. Even Australian driver's licenses are very hard to obtain fraudulently, and we have nothing comparable to SSN in terms of lameness as an identifier. (Our tax file number is similar, but providing it is optional, and its use is strictly controlled by law.)

Re:Ineptness to the point of being evil

[Jake Ease]

The article further quotes ChoicePoint spokesman Chuck Jones: But ChoicePoint has no way of knowing whether anyone's personal information actually has been accessed. Why the hell are they allowed to keep a dossier on me if they don't have any mechanism in place to allow them to track how it is used and by whom? This is insane!

Insane, yes; but I think it's also horsesh*t. I worked for them before the turn of the century, and they had a fairly thorough audit capability.

Re:Ineptness to the point of being evil

[Anonymous Coward]

Yep. It should be that way. You are responsible for verifying the identity of a buyer, and should therefore be responsible for the consequences therein.

I enjoy...

[softspokenrevolution]

I really enjoy how the graphic on the front page of their site reads: "Smarter decisions. Safer world."

It's pretty silly.

Re:I enjoy...

[Koiu Lpoi]

Heh, yes. It also says they were 'featured' in the Washington Post not long ago. Seems they're going to get 'featured' again!

if i *accidentally* ...

[GNUALMAFUERTE]

Run over someone with my car, i am responsable, and it's a crime. Even if i didn't mean to.

Companys should be held responsable for the data they hold.

Re:if i *accidentally* ...

[Anonymous Coward]

RE:Companys should be held responsable for the data they hold.

ya damn right they should!

Re:if i *accidentally* ...

[Koiu Lpoi]

Correct. However, there's no justice in this world. You're an individual - you hold FAR less power and influence than even a small corporation.

Re:if i *accidentally* ...

[Jeff DeMaagd]

I don't think the two necessarily connect.

Companies definitely should be held responsible for the data they hold, and the costs incurred by their mistakes.

But a driver that broke no law other than being at the wrong place at the wrong time shouldn't, and isn't necessarily held responsible. In the US, it really depends on the state.

Re:if i *accidentally* ...

[ScrewMaster]

More importantly, they should be held responsible for what happens to people when that stored information is stolen or otherwise misused. And if the punishing of that company for its negligence forces it out of business ... tough. It simply isn't enough to say, "Sorry, and oh, by the way, we've implemented some new security policies so this shouldn't happen again. We hope. Once again, sorry for the inconvenience." Really, it's more akin to collecting all kinds of flammable and explosive materials and storing them in a rickety old warehouse in the middle of a populated area. You shouldn't be able to get off with an apology and a promise to do better when that warehouse explodes, flattens the nearby buildings and kills a bunch of people.

Does that sound like an extreme example? Perhaps it is. But lives can be shattered in other ways besides being blown to bits. And I'm sure there will be a few deaths involved, as people with medical conditions suddenly find themselves without means, because some identity thief just bought himself a brand new house at their expense. No, the Information Age is proving to carry some serious risks, and those risks are largely due to cavalier treatment of personal data.

I'm not sure what it will take before some standards are put in place, with appropriate penalties for failure to maintain them. Probably won't happen now, with "tort reform" on the way and limits being placed on class-action lawsuits. Certainly not in the corporate-friendly period we find ourselves in. Hell, the government can't even enforce quality-of-service standards on the damn phone companies anymore. But at some point, enough people (enough voters) are going to get hurt by this problem that something will have to be done. The only question is whether the cure will be worse than the disease.

Re:if i *accidentally* ...

[wfeick]

The question is, what is a reasonable effort to maintain the safety of your data? If a company is making a good faith effort to keep their systems up to date with the latest patches, you probably don't have a reasonable case to sue them. I haven't seen anything that suggests their protection of people's data is analagous to "a rickety old warehouse in the middle of a populated area."

Don't get me wrong; it bugs me that there are companies whose sole purpose is to gather up whatever data they can find on me and sell it to whoever gives them money for it. One thing I would really love to see is a requirement that any data in their database have an attributed path back to the source of the information, so I know who is selling it to them.

Similarly, I'd love to see a law that requires any company who sends out junk mail to include in that mail a list of where they got a person's information from. If a magazine or web site knew that selling your information to a mailing list was going to cause their name to show up on all junk mail received from that mailing list (and transitively from any other mailing lists that that list was incorporated into) I suspect far fewer companies would be so eager to sell people's data for a quick buck.

Re:if i *accidentally* ...

[drinkypoo]

That's not necessarily true. If you had good reason to believe that you wouldn't run over someone (especially if you can somehow show that they got hit on purpose) then, depending on where you are and what everyone involved was doing, you might not be at fault.

On the other hand, these guys certainly should be responsible for the data they hold. The security that is expected of them isn't really very high, you can get access to all kinds of private information (like socials, addresses, blah blah blah) if you have a business and can use a web browser. They do require 128 bit encryption, if that makes you feel any better. It shouldn't.

Re:if i *accidentally* ...

[ScrewMaster]

I guess my point is that a "good faith effort" is not sufficient. Sometimes you have to do better. Sometimes you have to be required to do better. Now I'm sure that there are some database outfits that have topnotch security (whether they should be allowed to store that personal data is another issue.) But I'd bet dollars to doughnuts that there are a significant number of giant databases out there that are only marginally secured. My example of an exploding warehouse was only meant to point out that the information stored and sold by these companies isn't just bits on a hard drive, it's important ... and when that data is improperly handled there are consequences. People get hurt. And letting these companies off with nothing but an official apology will simply get more people hurt. If they want the benefits of keeping vast dossiers on us, they'd best be prepared to get bitch-slapped when they screw up.

I do like your idea of providing some accountability. The problem is that the audit trail could be pretty damn long, but that's okay ... just give me a page listing everyone that contributed to that file on me.

Re:if i *accidentally* ...

[btellier]

Uhm.

Let's say I run an online job market site. IIS backed with SQL server. A blackhat hacker uses an unknown exploit to break in, unauthenticated, to IIS. He then leverages this account to steal SQL credentials (or he uses an unknown SQL vulnerability) and downloads every resume we have on the system.

You're telling me that I should be charged with a crime?

To further your car analogy, you're saying if, while driving, my factory-faulty bumper comes off and brains a passing pedestrian that I should be liable? OK, maybe not, because I didn't know about it. How bout this: Ford tells me that my bumper might fly off, and that I have to take it to a mechanic ASAP. I decide to do it after work, but on the way to work, *thump*, I kill a pedestrian with my faulty bumper.

See the problem? It's not black and white.

Re:if i *accidentally* ...

[GNUALMAFUERTE]

Yup, i agree with you, but the point is:

If i drive an Alfa Romeo, and take it periodically to the mechanic, the car is in perfect conditions, i drive carefully, and somehow, because of a mechanic failure on the car, i injure someone, it's NOT my fault. OTAH if i driver a low-end car, that hasn't been taken to the mechanic in years, and that is a car designed for family use, and i am using it to travel to another town, at 160 km/h, and something bad happends, then it's all my fault.

There are thousands of companys that DOESN'T get cracked every year, and they are just as exposed to the net as the others, The ones that get cracked are being obviously negligent.

ALMAFUERTE

Re:if i *accidentally* ...

[martinoforum]

OK, let's assume you do run this job market site. You're not doing it for a favour, right? I'd assume there's some profit there.

If you're profiting from storing and redirecting personal information then I think it's entirely reasonable to fine you for losing your grip on it. If you find IIS and SQL server too vulnerable to securely store the data of private individuals, you might wish to spend a bit of money on obtaining systems with a better security profile and hunt for a vendor who will assume liability in the event of a failure.

If laws to this effect were passed, new "secure data systems" industries would appear, backed by liability insurance that would cover the eventuality of a failure. You would be able to call a contractor to install a system that would be backed by a security guarantee - assuming that correct procedures were followed. This doesn't just assume 100% secure software, all personal information could be encrypted at time of receipt to the public key of a machine which has no online presence, then transferred in a physically secure manner. Physical security is a much better known quantity than IT security these days, so forcing private data to be handled this way might even be a safer bet. ... the end result of this would be that you would make a bit less profit on your job market site, but on the other hand the individuals using your site would not be at risk from data loss in the same way that we've seen here. As it stands, what's to stop you saying "Oh, I keep the patches up to date... it's not my fault I got hacked!". Well yeah, but you didn't exactly do anything more than trust a manufacturer that assumes no liability in the event of failure. If Microsoft would assume liability that'd be another issue, but as things stand I think it's quite fair that the buck stops with you in those circumstances.

If there's an industry that can only survive profitably by playing fast and loose with other people's private details, it has to be questioned whether that industry deserves to survive.

Re:if i *accidentally* ...

[Anonymous Coward]

fyi -
doesn't (does not) - is for singular 3rd person.
don't (do not) will work fine here.

Re:if i *accidentally* ...

[btellier]

OK, let's go with a hypothetical scenario: newly hired Jr. admin Tibor is surfing the web and picks up a trojan from one of the many IE vulnerabilities out there. It logs all keystrokes and periodically silently POSTs them to some website. The company tried to prevent this with up-to-date anti-virus software on the corporate PC's, but this user contracted the trojan on his non-corp domain PC. Tibor's dualboot linux/winxp dev box, let's say.

Using Tibor's stolen credentials the crackers are able to log in and steal various confidential infos. Do you press charges against the entire company based on the bonehead of one admin? What if the cracker accessed the corporate network via the contractor's PC, or the intern's? At some point it isn't always negligence, and where that point is is very debatable.

Re:if i *accidentally* ...

[SillyNickName4me]

Well, only marginally secured does not make for a good faith efford, so what is the problem exactly?

Re:if i *accidentally* ...

[martinoforum]

I think you're missing the point here by trying to make a nice complicated story. Essentially in your example, a failure occurs. Failures should not occur in this situation. Therefore a hefty fine is entirely reasonable. If your Tibor character breached internal policies in his mission to acquire this trojan, the company can act against him after they get fined. The financial loss can be their reward for failing to ensure their internal security is properly enforced with respect to people capable of opening up sensitive data.

If that internal security policy didn't exist, on the other hand, the company deserves everything it gets.

It is possible to implement systems with "good enough" security, if you're willing to spend the cash on it. And it's also possible to implement internal systems with "good enough" systems of trust and physical security to prevent regular thefts of valuable materials. Banks have been doing it successfully for a long time, and where the systems fall down there are backup plans intended to deal with the fallout. I don't lose the contents of my bank account when a branch gets cleaned out. The fact that this level of thought and attention is not being paid to personal information suggests that - basically - the incentive to do it does not exist. Let's make it exist.

Re:if i *accidentally* ...

[Money for Nothin']

Hence, we have things called "class action lawsuits", in which many individuals team up to hire a good lawyer or two to take on these corporations who also have a good lawyer or two...

(President Bush wants to limit class-action suits, however. I don't like it either.)

Re:if i *accidentally* ...

[jelle]

The answer is yes, because you put the info out there.

I'll give a more adequate analogy: If you hold the baby over the railing of a balcony, you are responsible if the baby falls.

Why? Because the baby was defenseless against your actions and you put it in a dangerous place. Plus, you are the guardian of the baby.

Sensitive, identifying, and personal information is defenseless against people putting it in dangerous places where that information can be taken and abused. You are the guardian of the information.

Re:if i *accidentally* ...

[EEBaum]

And if the punishing of that company for its negligence forces it out of business ... tough.

So long as they don't have a "Going Out of Business" sale...

Re:if i *accidentally* ...

[dgatwood]

IMHO, the people who designed the broken system should be held responsible for fraudulent use, regardless of how that information was obtained.

For example, if your credit card number stolen because of an insecure server, the card company should be liable for the entire extent of the damage. The credit card number should not have been vulnerable to a replay attack. It's a fundamental flaw in the notion of a number being used to identify a person. This should not occur, and the card companies should be required to fix their screw-up. Credit cards should include a photo ID and a smart card type technology. The only place where there should even be a slight chance of fraud is online, and even then, only if your card is physically stolen.

For social security numbers, the government should be responsible for ensuring that fraudulent use does not occur, and should audit the hell out of this. Use of SSN should be audited nationally, and if your IRS tax statement comes from California, but somebody just requested a credit card in New York, they should be able to reject the use of that SSN. Again, it should not be used as an identifier, but should be a mechanism for authenticating into a federal registry that should have reasonable protections against improper use of that number, up to and including easy revocation of that number should there be evidence that it has been stolen.

Such a mechanism needs to include automatic notification of the new SSN to existing creditors, a reasonable, standardized process for correcting erroneous fraudulent activity with existing creditors (which should rarely occur if the Federal database works correctly), and the subsequent permanent refusal of any attempts to authenticate against that SSN for all eternity.

I just checked my info from the annual credit report website. No big surprises, but Experion is incompetent. They had no less than three erreous addresses and two incorrect spellings of my name on file. I wouldn't trust companies like that with my luggage, much less my credit score.

That's what scares the hell out of me is that protection against theft of my credit depends on this bunch of incompetent morons who can't tell the difference between David Gatwood and David Gatewood, or worse, between 401 Heller Dr. Box 61 and P.O. Box 61 in DIFFERENT ZIP CODES. (One was a campus zip code, the other wasn't.)

As far as I'm concerned, the fair credit reporting act is a good start, but it doesn't go anywhere near far enough in kicking this bunch of misfit companies into taking security and correctness seriously. Personal information is way too easily misused, and companies are way too lax about verifying personal information.

Re:if i *accidentally* ...

[dgatwood]

More than that, the question is bogus. No computer containing credit card information should have anything less than an air gap between it and the internet. On most web sites, it is entirely practical for the credit card transaction to occur and for the data to be disposed of immediately. If the card transaction fails to occur immediately, the info should be printed in a way that the transaction can be restarted ONLY with human intervention.

If continuing account activity is required, the card number should be printed as a bar code (encrypted with a public key, if desired), along with the account number. A person should carry that piece of paper to the billing computer, which should NOT be on the public internet, nor anywhere near it.

There is no excuse for credit card information to reside at any time on any system that is connected to the net, regardless of how 'trusted' that system is. Trusted just means that somebody else gets sued. You still have the embarrassing responsibility of telling your customers that you leaked their credit card numbers and that they are being used the son of a former Nigerian minister, or whatever.... No, the right way is to not expose yourself to the potential for such a problem in the first place.

Re:if i *accidentally* ...

[SillyNickName4me]

With regards to SSN, no, the entire problem is that it is used to authenticate things instead of as identification. Identification would still require authentication to take place and that makes a SSN a lot less usefull for criminals. You are right about that CC companies should prevent replay attacks based on numbers and that numbers dont provide good authentication. I find it a bit strange that you then argue that the SSN (wich is vulnerable in the exact same way) should be used as authentication.

The problem is not that a creditcard is indentified by a number, but that that number is all you need to authoriye a payment (so, it also authenticates it) and the same applies to SSNs and any other such numbers.

I happen to live in Europe, and if I want to withdraw money from my bankaccount, I need 2 things:
- something that identifies the account I want to withdraw money from
- Proof of my own identity

The later can be a simple number (bad) or some challange response mechanism that requires me to be in physical possesion of an item as well as having knowledge about some secret (a lot better)

Re:if i *accidentally* ...

[dvaldenaire]

>See the problem? It's not black and white.

Exactly. That's why laws can't define every case. And that's why law is totally useless, because every case not treated (as in the present situation) will have to be thought about.

Law is just there to make the outcome of some of your actions predictable: For doing this, or that, you will be fined/punished/etc or not.

Not irony here. Just trying to compare the way it goes in software engineering, where all the cases have not been carefully studied.

Re:if i *accidentally* ...

[qwijibo]

That's not as funny as it seems. Companies who have information as "assets" have sold those as part of settling their debts.

Re:if i *accidentally* ...

[evolutionaryLawyer]

Actually, that isn't true. There are many situations where you can cause harm to another and not be held responsible criminally or civilly. There is the legal concept of "due care". If you do something with due care and harm results to someone else, you are not responsible, whether you hit them with your car or reveal their private information. I am not saying this company lived up to their duty of due care, but if a court finds that they have, they have no liability.

Re:if i *accidentally* ...

[GNUALMAFUERTE]

Hiring a sysadmin that browse the web with a browser and operating system which are known to have serious vulnerabilities, in the same machine where, say, he keeps rsa keys that are authorized to connect to the servers he manages, is NEGLIGENT. And it's the company's fault if something happends.

Re:if i *accidentally* ...

[Anonymous Coward]

You think you're extreme? I think ChoicePoint should be out of business over a fuckup this big. Up to potentially 30,000-35,000 lives could be ruined over this. It's just about par with murder IMHO. Each person should be able to sue the pants off of ChoicePoint.

Re:if i *accidentally* ...

[ScrewMaster]

It's probably worse than that. It's just that California has a law that requires them to inform people when their records have been compromised (according to the article) and law enforcement gave them the go-head to do so. Other states may or may not have such a law, and consequently no-one outside of California has been notified. In fact, I find it highly unlikely that only residents of California were affected by this ... chances are a lot more information was stolen but ChoicePoint doesn't have to tell anyone so they aren't. They even admitted that they can't tell for sure what was taken, if anything, or for what purpose. Makes me feel secure, let me tell you. Nothing like accountability and a clear audit trail (they should have used some of their much-vaunted storage capacity for a few log files, maybe.) Californian or not, I'd still keep a close watch on my credit report for the foreseeable future.

Legal question

[mctk]

Supposing my identity stolen and used for fraudelent activity. If we could trace the identity theft back to ChoicePoint, could they be held liable (in any sense of the word)?

Re:Legal question

[MillionthMonkey]

Supposing my identity stolen and used for fraudelent activity. If we could trace the identity theft back to ChoicePoint, could they be held liable (in any sense of the word)?

Ordinarily in a case like this a class action would be brought against the company. The "Class Action Fairness Act" will shift class actions from state to federal court. Ostensibly this was done to prevent venue shopping- where you look for the state with the most favorable laws for your class action suit- but it also has the nice property that federal courts rarely agree to hear class action lawsuits, citing differences in state law. The Act effectively puts an end to all class action suits without explicitly banning them.

If you're a victim of identity theft because your Social Security number was compromised by ChoicePoint, you'll have to hire a lawyer yourself, prove that the identity theft was a result of ChoicePoint's negligence, and your case will be heard separately from those filed by any other plantiffs.

Re:Legal question

[Anonymous Coward]

Nope. They aren't. They are only collecting publically available information, if you don't want to have them know something then you shouldn't use a credit card. Why should the govenment meddle in private affairs?

Re:Legal question

[Anonymous Coward]

Boy, am I pissed.

Since these scumbags don't seem to have much regard for the law, their liability, or safeguarding the data that they have collected, perhaps it's time for some activists to work a bit "outside the law" to make them see the error of their ways. Any volunteers within a 1/2 day driving distance to their facilities?

Re:Legal question

[Anonymous Coward]

If we could trace the identity theft back to ChoicePoint, could they be held liable (in any sense of the word)?

If your credit card information is stolen the banks go after the last place it was legitimately used to see if there's a pattern of that store not tearing up receipts or having some sort of break in. Then they recoup their costs (as the customer only pays $50) from that company.

It would be nice if the same thing applied to consumers with banks / report bureaus.

Re:Legal question

[Anonymous Coward]

The legal issues are ambiguous. The imposters who conned ChoicePoint committed at least one and probably several crimes in order to get the information. Being the victim of a crime is often considered a defense (or at least a mitigating circumstance) against accusations of simple negligence.

A parallel situation might be if someone broke into your home and stole your firearm then used it to commit murder. In that situation, can you be tried for the murder? If you took even average precautions and complied with your local laws, the answer is no. The commission of the first crime insulates you from liability of any future crimes committed with your property.

The standard that would probably have to be met in a lawsuit against ChoicePoint is one of gross negligence - a fairly high bar. You would have to prove that they took risks which no reasonable person with similar experience or knowledge would take. And since others in the industry follow similar practices, it might be a hard argument to make.

Of course, the other place to hold them liable is in the Court of Public Opinion. If enough people stay angry at them for long enough to affect their revenues, it will change their behavior.

So who ELSE is affected!?

[Buran]

The story says that these things "are seldom limited to a single geographic area" ...

SO WHO THE FUCK ELSE HAD THEIR INFO STOLEN!? WHAT STATES!?

We want to know! NOW! Why are they refusing to disclose vital information? I'd be VERY angry to find out that someone committed identity theft, these people knew of the stolen info, and they didn't tell me.

Re:So who ELSE is affected!?

[LostCluster]

They're only telling the California residents because only California has a state law that requires notification... sound like a law that needs to be passed in 49 other states.

Re:So who ELSE is affected!?

[petsounds]

It's a good start, but I don't think it goes far enough. There's no requirement to publically acknowledge break-ins, only that individuals be notified. For instance, T-Mobile has yet to publically fess up for their year-long security breach and show no signs of ever doing so.

Re:So who ELSE is affected!?

[Anonymous Coward]

^mod parent up

Re:So who ELSE is affected!?

[Buran]

That is not an excuse. The fact that you happen to live in another state doesn't mean they have less of an obligation to you.

So I say again, where is the disclosure?

Re:So who ELSE is affected!?

[|<amikaze]

Well, from a legal standpoint, it certainly does. If there is no law in your state requiring them to do so, then legally they don't have that obligation to you. Morally, I believe they are obligated to, but morality isn't the same as legality now is it?

Re:So who ELSE is affected!?

[greenplato]

This is a great time to hunker down and read Harry Frankfurt's essay "On Bullshit."

This fellow James Lee is the Jackson Pollock of bullshit artists. I can see how this statement cound get the parent's goat: "Lee said law enforcement officials have so far advised the firm that only Californians need to be notified."

Of course, because California is the only state that requires notification. Duh.

You read his statements and they stick out like a sore thumb, in opposition to the universe as you know it. You wonder if he is either incompetent or lying. But it's really neither, he bullshitting you. This is what Frankfurt says:

It is impossible for someone to lie unless he thinks he knows the truth. Producing bullshit requires no such conviction. A person who lies is thereby responding to the truth, and he is to that extent respectful of it. When an honest man speaks, he says only what he believes to be true; and for the liar, it is correspondingly indispensable that he considers his statements to be false. For the bullshitter, however, all these bets are off: he is neither on the side of the true nor on the side of the false. His eye is not on the facts at all, as the eyes of the honest man and of the liar are, except insofar as they may be pertinent to his interest in getting away with what he says. He does not care whether the things he says describe reality correctly. He just picks them out, or makes them up, to suit his purpose.

Re:So who ELSE is affected!?

[drinkypoo]

Actually, this is what happens when the system becomes too objective. The reason we make it subjective is that we are attempting to make things fair. The problem with that is that outside of a fascism it is impossible to make it so, because you cannot reliably enforce all of the laws equally and appropriately. Instead of appointing people we can trust to public offices and other positions of importance, we attempt to construct a system of law that will accurately address every situation. It does not typically believe in mitigating circumstances except in situations where it feels that everyone has done wrong.

Anyway, this is the prison we built for ourselves, and as a result the fact that you happen to live in another state means they do have less obligation to you, as that word has any actual meaning anyway. Otherwise we'd be within our rights to march down there with torches and pitchforks and perforate 'em.

Re:So who ELSE is affected!?

[Buran]

I say we perforate them anyway, I don't give a crap what kind of excuse they have for not helping to prevent fraud. In the industry they're in there's no excuse.

[Cue up the mob scene from Beauty and the Beast]

Re:So who ELSE is affected!?

[Anonymous Coward]

Americans may not be the only ones affected by this.

Here in Canada, if you do business with a Canadian company which is subcontracted or owned by an American company, any information given to the Canadian company is, by virtue of the Patriot Act, entered into the American company's database so that the US government can look at it if/when it wishes. If Choicepoint falls into this category, Canadian (and presumably other countries that do business with Choicepoint in this manner would be treated in a similar fashion) citizens' information is also at risk.

The difference is that at least Americans can try to do something about it, being in the same country as the business (i.e. Choicepoint). Canadians and citizens of other countries have NO recourse whatsoever.

Big Money wins again.

Re:So who ELSE is affected!?

[Anonymous Coward]

That was an interesting read, thanks for the link.

Re:So who ELSE is affected!?

[jim_v2000]

Why are they refusing to disclose vital information?

Maybe they don't know?

Re:So who ELSE is affected!?

[jk0]

Please try to keep it clean, some of us spend all day at work here...

Re:So who ELSE is affected!?

[Anonymous Coward]

Please try to keep it clean, some of us spend all day at work here...

Um, if you're looking to avoid profanity, why are you browsing slashdot comments?

Re:So who ELSE is affected!?

[jk0]

I have nothing better to do?

Re:So who ELSE is affected!?

[zoolander$56]

time to sue, lets put these scammers out to dry where they belong, teach also Experian and EquiFAX on how to handle consumer data. If these corrupt outfits go belly up, no one will play any version of this game again. https://www.lawyersandsettlements.com/case/choicep oint2

Re:So who ELSE is affected!?

[zoolander$56]

check out the application these criminals used(faxed)to forge their way into our OWN data, Google bots found it. http://www.choicepointonline.com/wpsapp.htm how freakin' easy is that?

Re:So who ELSE is affected!?

[zoolander$56]

You gotta read their' agreement of service', boy they opened the door here---its HIGH time WE SLAMMED it~~ .." WHEREAS, ChoicePoint desires to sell such employment reports to Customer. (d) Defend and indemnify Customer from and against liability, losses, costs, expenses and damages for claims or litigation brought by third parties, caused by, or arising, from any violation of law or the negligent acts or omissions of ChoicePoint, its officers Customer agrees to do the following: (a) Keep all reports, whether oral or written, strictly confidential and, except as required by law, reveal information from reports only to the Consumer or a person whose duty requires him or her to participate in the decision for the transaction for which the report was ordered. (b) Request information for its use only unless Customer has obtained written permission from ChoicePoint to request the information for use by other persons. If Customer purchases motor vehicle records ("MVRs") from ChoicePoint, Customer agrees to the following: (i) Customer shall not use any ChoicePoint provided MVR, or portions of information contained therein to create or update a file to the end that Customer develops its own source of driving history information. ChoicePoint shall have the right to conduct periodic audits of Customer's use of the Consumer Reports and Investigative Consumer Reports ordered pursuant to this Agreement. ChoicePoint will provide reasonable notice prior to conducting any audit. ChoicePoint shall have the right to select the counsel and direct the defense with respect to such claims, and Customer shall cooperate with ChoicePoint in any such defense. Notwithstanding the above, ChoicePoint's indemnification obligations under this Agreement shall be limited in the aggregate to One Hundred Thousand Dollars ($100,000.00) during the term of this Agreement." https://www.employment.screennow.com/cgi-bin/publi c/subscribe?pcode=cuzzens Let this be a lesson. What lawyers let this verbage fly?

Thats only what they are required to report

[Anonymous Coward]

The 35,000 people are all in California. There are probably hell of alot more peoples data stolen. Since the only state that requires stolen data to be reported is Cali. Whats 35,000 * 50 states.

Thats what I call one big screwup

Re:Thats only what they are required to report

[Koiu Lpoi]

I highly doubt they would refuse to report that data had been stolen from other states, just because they don't have do.

Re:Thats only what they are required to report

[Eric Smith]

Then let them publicly deny that any data has been stolen relating to residents of other states.

I very much doubt that they're willing to do this. They're only providing any notification becuase they're required by law to do so; left to their own devices they would ignore it entirely.

Re:Thats only what they are required to report

[FuzzyDaddy]

1. Lee [Choicepoint spokesperson] said law enforcement officials have so far advised the firm that only Californians need to be notified.

2. The incident happened months ago, and ChoicePoint just got permission from law enforcement to disclose the incident.

I would say it's pretty likely they wouldn't report data thefts about people in other states...

Re:Thats only what they are required to report

[Koiu Lpoi]

Good point, I forgot for a moment we were talking about a corporation.

Re:Thats only what they are required to report

[zedzedalpha5]

:)

I worked for this company from 1999 until 2003. This is a minor problem compared to the other things that have happened there.

Google "Choicepoint foreign". Ah, that was a fun project.

Welcome to the downside...

[ducomputergeek]

of our information driven world. Something like this was bound to happen eventually and highlights something that really needs to be brought back into the focus of public discource: just how much information should be readily available. Your credit score now is one of your most valuable assets and something you rarely heard about five or ten years ago. Now its mentioned every 30 seconds. Because of the ease of gaining this information, employers, and just about anyone can get your credit score even if legally the shouldn't be.

Next big issue is going to be medical records online. While having such information in once location could be of great benefit to doctors and hospitals around the world, there are also dangers as well, like your HMO, employers, or if your a public figure, the media getting their hands on otherwise private medical records.

Re:Welcome to the downside...

[demachina]

The desperate need is for social security numbers to be replaced with an encrypted digital signatures, and when you use it for something there is an authentication test required to prove you know the password to it.

The idea that your life can be destroyed if someone just acquires your name and social security number is insane. Social Security numbers are security through obscurity and they completely stopped working when the Internet came in to being.

And no I don't want the government to institute an all knowing, all seeing national identity system, which appears to be what they are shoving down the throats of states through drivers licenses, which will apparently become a unified national ID unless a state decides to forgo Federal funding for things like highway construction.

I just want them to mandate that secure digital signatures superceede social security numbers.

Re:Welcome to the downside...

[RobertLTux]

Due to the federal guidelines/regs (google for HIPAA) is is a felony to have your medical records on a unsecured computer. chances are any NET transmit of medical records will be via a ssl tunnel or otherwise secured for transit. Yes this bit does only apply to USA persons but i would think "YOUR" regs should be better

Re:Welcome to the downside...

[Anonymous Coward]

Everyone has always been able to get your credit score. The only difference is that more consumers know about it now.

Once you fill out a form online and get an instant credit decision, you start connecting the dots.

Any social engineer should and will see it for what it is - an opportunity.

The only thing that someone requires to get your score is your consent - and not even written. I can go into a bank and say "give me a credit card". they say "i need your social, ok to look up your report?" that's it.

They can also write to your report.

There's no fix to this "problem", aside from a system where the the credit bureaus have to contact you to authorize a lookup. It will never happen. Just go on living your lives and make sure you keep an eye on your accounts and credit reports.

Thankfully, most companies are becoming wise to ways to verify the identity of the customer (to prevent fraud), and verify a connection between the suspect customer and delivery of goods or services. Credit cards have come a long way (though there's still more to do), direct credit related purchases are getting there too.

Let me be the first to say,

[Koiu Lpoi]

That's bad, isn't it. Yes, that's bad.

poor credit score keeps me safe.

[isbhod]

My credit is so poor that stealing my identiy is only going to hurt them. I mean they think they are gettign a free ride, but when Rocko breaks down their door looking for past due payments boy will they be in for a suprise, hell this might be the best thing to ever happen to me!

Re:poor credit score keeps me safe.

[Landaras]

Your post reminds me of what I tell my female friends.

I am at a negative risk of contracting STDs. As in, not only is my likelihood non-existent, but the more time you spend around me, the more your likelihood of contracting anything goes down.

Yes, I realize I am posting this with on Valentine's Day. I believe anyone who can't laugh at themselves needs to lighten up :).

Re:poor credit score keeps me safe.

[Anonymous Coward]

http://ars.userfriendly.org/cartoons/?id=20030220
The great western dream adds up, dude :)

Re:poor credit score keeps me safe.

[Anonymous Coward]

Worst case scenario when discovering id theft: "Hey, when did I get this life insurance policy?"

So, bad credit is not a deterrent for the determined.

Re:poor credit score keeps me safe.

[blindbat]

What you don't get is that Rocko will be banging on your door :)

Re:poor credit score keeps me safe.

[Anonymous Coward]

It's Rocco, punk, and he knows where you post from. ;-)

Acceptable losses

[erroneus]

Incidents such as these are actually rather rare. People abusing information collected either through neglect or in other ways is not as common as proper use.

All those foolish people who protested the collection and sale of personal data of private citizens should be ashamed since the prosperity of this country depends greatly on the efficiency of business. And if you don't like it in this country any more go some place better! There isn't any place better you say? Then shoot yourself now because there's nothing you individuals can do to change things to your liking anyway.

(The preceding was stated as an opposite to my actual feelings on the matter to illustrate how ridiculous I feel the opposing view might be. There are no acceptable losses when it comes to privacy and the right of everyone to keep what they have earned. Loss of privacy opens the door for unscrupulous people to do bad things and reduces an individual's ability to protect one's self.)

Re:Acceptable losses

[amishdisco]

Yeah, business and prosperity create some pretty formidable blinders. I think that last time Americans freaked out on a sitting government, we realized that specie was meaningless without the security of our personal liberty. Nobody really learns from history.

Re:Acceptable losses

[Anonymous Coward]

1. Prosperity of U.S. depends on its military might. It spends more then it produces. Its living standards and its billionaires are living on borrowed time and money. And the world won't be held hostage to greed of a small layer of Americans forever.

2. There are better places, but not many and they are not easy to get to. Particularly for Americans, whose isolationist, arrogant culture makes them unwelcome in most of the world.

3. Nobody BUT individuals can change things, to OUR liking. WE are in the majority. Nobody can fight the system. The Man and The System are an elaborate illusion. We CAN fight the small number of rich assholes who run things. As for what eventually happens to them, see: French Revolution of 1789. Hint, it involves a certain Madame Guillotine...

Re:Acceptable losses

[erroneus]

I'd really like that to be true... I just can't see it happening. I just don't think people are all THAT uncomfortable yet.

In reality, there seems to be at least one thing "they" have learned from history. If they manage to keep their livestock (read: "We the consumer") happy, they have nothing to worry about... just the cost of doing business right?

Re:Acceptable losses

[tgrigsby]

All those foolish people who protested the collection and sale of personal data of private citizens should be ashamed since the prosperity of this country depends greatly on the efficiency of business.

I had already started to type a heated reply to this when I saw the next paragraph. You got me!

I'm in total agreement with your true view. Having my personal information does not make companies more efficient, and while I'm not against the collection of personal information, I'm against the distribution of personal information without my expressed written permission. Like it or not, your identity is digital now. Sale of that identity should not occur without proper safeguards, and companies that engage in the sale of such information should be legally obligated to provide financial protection and fraud detection services to those affected. Period, end of story.

Well done.

'legitimate'

[convolvatron]

exactly what criteria are used to distinguish between a 'legitimate business' and someone who is going to use the information to steal my identity. or someone who, inadvertently or not, will pass the data to someone who is. the whole model is flawed.

Re:'legitimate'

[TheOriginalRevdoc]

Simple!

A "legitimate business" is one that pays the access fee for the data.

The real problem here isn't the break-in...

[Anonymous Coward]

They say "Criminals posing as legitimate businesses have accessed critical personal data stored by ChoicePoint Inc."

If the data was that critical and personal, why was it available to "legitamate businesses" in the frist place?
Are a set of articles of incorporation and a pile of money all I need to 'legitimately' access "databases of background information on virtually every U.S. citizen"?

Re:The real problem here isn't the break-in...

[Koiu Lpoi]

To answer your question, yes. I'm suprised that you're suprised.

Re:The real problem here isn't the break-in...

[AndroidCat]

They're only criminals because they didn't pay for their access, duh. ;)

Re:The real problem here isn't the break-in...

[jd]

First, this isn't Europe, where there are strict laws against databases of personal information without the person's knowledge and consent. (And, trust me, I'm not about to give any data-mining firm consent for anything.)

Second, "criminals posing as businessmen" could apply to most US firms and most branches of the Government. No, forget the Government, they already have the Patriot act.

On a serious note, expect such crimes to increase in number as more data is computerized. Furthermore, don't expect any of the data management teams to give a damn about security, because it's not data on them. If their own lives and finances were at stake, these sites would be sealed up tighter than Fort Knox.

I wouldn't worry too much, though. Although many records will be sold to "undesirables" (which means your name will be on the "do not fly" list) most of the contact information will be sold to spammers and the RIAA.

Re:The real problem here isn't the break-in...

[dbIII]

They're only criminals because they didn't pay for their access, duh. ;)

That makes them illegitimate businesses - the bastards!

Re:The real problem here isn't the break-in...

[Anonymous Coward]

Probably if you have wheel-barrows of money you can buy just about any data that you want to buy.

that is probably a good way to get secret and illegal data.

Does this surprise you?

Re:The real problem here isn't the break-in...

[Anonymous Coward]

Yes.

All you need to access these databases are a business. There are countless companies out there who provide the same type of service that ChoicePoint does, access to virtually every American citizen's personal information. All you do is provide them some type of documentation for your company, and you pay the bill, thats it. You now have access to a person's life story, SS#, mother's maiden name, house you grew up in, your neighbor's telephone #, you name it...

The issue in my opinion (as someone who uses a service like ChoicePoint) is that ChoicePoint did not do their due diligence in confirming these 'criminals' identities. This whole thing is their fault, whether the courts agree or not, and they deserve their dropping stock value.
I realize the seriousness of this, because of my line of work which involves verifying people's identities for online purchases. All you need these days is a name, address, and bank acc#, or credit card #, and you can use Paypal, for instance, to clean a person out. You can apply for credit cards in someone else's name, if you have enough info. Hell, you could become a person (with the right info) if you were clever enough!

From: http://choicepoint.com/about/overview.html

[wizzardme2000]

"For almost a century ChoicePoint has been a trusted source and leading provider of decision-making information that helps reduce fraud and mitigate risk."

Rrriiight....

Excellent!

[Anonymous Coward]

Well, this is really excellent news. American Radio Works did a show partially covering ChoicePoint's data gathering activities recently:

No Place To Hide

It was truely disturbing. Now that we're permanently at war with the Forces Of Evil (terrorists, for now) people should get used to not having any privacy. Sigh.

Re:Excellent!

[TubeSteak]

^bump^

Doesn't matter if you're for looser privacy laws or not; that article makes a good read.

The most interesting part (for me at least) was that one guy could narrow down a list of 450+ million names to 419 people and manage to get 5 of the 9/11 hi-jackers on it.

Any math nerds want to figure the odds of that? (Keeping in mind that he automatically threw out the names of everyone not young, male and muslim)

Re:Excellent!

[roman_mir]

Can you recognize these words: The Indistructable Union of Free Republics was Bound Together by the Great Russia..... and so on? This is the literal translation of the anthem of the USSR.

What does the US anthem say? The Land of the Free and Home of the Brave, right?

A big cosmic joke.

Never heard of these guys

[Anonymous Coward]

What is their relationship with the Arkansas outfit Axciom whose computers were hacked into awhile ago?

And what do either of them have to do with Intellectual Ventures, UCANN and the Carlyle Group... well OK, let's start with Axciom first.

Re:Never heard of these guys

[AndroidCat]

Ah yes, that's who I was thinking of! ("Hey, isn't this story some kind of slow dupe?")

Re:Never heard of these guys

[Joseph_Daniel_Zukige]

What is their relationship with the Arkansas outfit Axciom whose computers were hacked into awhile ago?

And what do either of them have to do with Intellectual Ventures, UCANN and the Carlyle Group... well OK, let's start with Axciom first.

And let's not forget that Microsoft wanted a piece of this action. (Passedport, anyone?)

No mod points for the parent.

Do a little quick math

[JoeShmoe]

California, population approx 30 million, or 1/10 of the US population.

So, the number of stolen identies is probably closer to 300,000 to 350,000. Only California has a law that forces companies to disclose these kinds of risks to personal data, but I think it's a fairly safe assumption that the theives didn't target just California records (in fact, if they wanted to use them for identity theft, it would make more sense to excluse California records because those indidivuals would be on alert).

So, potentially one in every one hundred people in the US now has their electronic profile available for identify theft. That's a scary (although I'll admit unlikely) idea.

Closing question...what exactly is the f'ing differences between a "legitamate" company accessing this ChoicePoint database an an "illegimate" company? Wouldn't theft of database access be just as much a risk? If Sam's Wholesale Cookies can browse through the database, concievable so can any employee of Sam's Wholesale Cookies or anyone who breaks into a Same's Wholesale Cookies computer. Is there not a single person in all of government who sees the folly of having all the eggs in one basket? Not even a secure basket...the free sample basket by the front door of the mall.

- JoeShmoe
.

Re:Do a little quick math

[drinkypoo]

U.S. Law allows for certain types of personal information to be made available to people for certain reasons, such as the collection of debts. The databases are very interesting to look at (which I have done legitimately in the course of attempting to collect some debts, when my father was working for a company that did that. I found it distasteful and went out of my way to avoid calling anyone, and just doing computer searches...)

The databases basically involve public records from every county in a state describing ownership, professional licenses, et cetera. They often include every piece of information involved in submitting a request for some type of certification. Land deeds, for example, are in there, as well as contractor's licenses. A lot of that information is public record, but the stuff that isn't is the address (that's sometimes but very rarely public) and sometimes social security number. If you can establish that someone was at a certain address, and get a social from that address, hopefully correlating it with another address and matching (or near-matching) social security number, then you can look that ssn up in connection with all kinds of other items. This can connect them to any number of other people who you can bother for their phone number.

Eventually, you can find property, and depending on what state it's in you can sometimes take it away. California makes it pretty hard to do that kind of stuff to someone; you can't take away a home which is also a business, for example, and you can't take away someone's primary automobile -- unless you're the lien holder, that is. Or, well, the federal government.

Notice above I said something about a near-matching SSN? All of this stuff is near-matching. The problem is that someone might write their name (or other information) carefully in one place and illegibly in another. They might of course also forget or "forget" the number and misenter it. Finally, let us not forget the wonders of data entry and the errors therein. Some forms are OCR'd (anything typed) and some were probably hand entered. The record only goes back so far as well, but it's generally pretty far.

Anyway, anyone with a business that has a reason to need to do that kind of thing can get access to those databases. They can tell what you were doing with it, so if you do something naughty, they could tell.

legitimate == paying

[Anonymous Coward]

They probably just got stiffed on the access charges.

"Criminals posing as legitimate businesses"

[toby]

C'mon! Does every story on /. have to be about Micro$oft?

Re:"Criminals posing as legitimate businesses"

[Anonymous Coward]

lol, i get it, too bad the moderators did'nt

Re:"Criminals posing as legitimate businesses"

[Anonymous Coward]

> lol, i get it, too bad the moderators did'nt

everyone *got it*, it just wasn't funny.

Re:"Criminals posing as legitimate businesses"

[Anonymous Coward]

Not really... some are about $CO

No Changes Forthcoming

[zentec]

The government is one of ChoicePoint's largest customers, so you can be certain that there will be zero rules and regulations imposed on ChoicePoint or similar companies. Nor will you see any changes to the Fair Credit Reporting Act, which affords no penalty to companies that report wrong information on individuals other than once proven incorrect, it is removed.

If this incident doesn't create intense public outrage and a rash of calls to legislators demanding change, then I doubt there will ever be changes that protect individual identity and information.

Furthermore, I would propose that every individual that finds ChoicePoint's egregious lack of security reprehensible, to draft a letter demanding a full explanation and any details relating to whether or not their information has been stolen. I don't expect this company to come clean, but just imagine the hassle of having to reply to hundreds of thousands of letters.

Maybe having to deal with thousands of peeved off consumers will clean up their act.

Re:No Changes Forthcoming

[MerlynDavis]

For the most part, Choicepoint deals in public records...items that are available to the general public (if you have the time, energy, and knowledge of where to look).

However, there is some data they possess which isn't public records (DMV records mostly) which require special privledges to access. I would hope that they actually review who has access to that information, and not give it out to persons without legitimate needs.

I think the main concern is that fact that this data is aggregated for use, without any sort of controls on who can see it, and for what reason.

Re:No Changes Forthcoming

[asr_man]

The government is one of ChoicePoint's largest customers

Then we can hope that enough high-ranking members of Congress, Justice, NSA, and the Armed Services having their information compromised will motivate them to do something about it.

good reason to...

[Anonymous Coward]

stay off the grid as much as humanly possible...

No obvious notice appears to be on their website.

[BossMC]

"No obvious notice appears to be on their website."

You think? The last thing they need is a ton of people making transactions of various sorts to plug the logfiles. Further, the less this gets out, the less chance of it being exploited by uninformed black hats!

More of ChoicePoint's greatest misses

[Platinum Dragon]

People opposed to the Bush victory in 2000 claim that ChoicePoint may have aided in voter disenfranchisement.

*This is not an endorsement of the linked site or the opinions expressed there. I just recall these claims from a Slashdot submission I made a couple years ago related to this.

Re:More of ChoicePoint's greatest misses

[Anonymous Coward]

oh come now. We all know that Kos is a flaming pinko commie ;)

Re:More of ChoicePoint's greatest misses

[Anonymous Coward]

Why the smiley? Zuniga IS a flaming pinko commie.

Re:More of ChoicePoint's greatest misses

[Anonymous Coward]

Uh huh. Sure he is :rolleyes:

Just because you fail to share somebody else's values doesn't mean they are a commie. Grow up child.

Remember the Florida election of 2000 ?

[furballphat]

Remember the Florida election of 2000 when a private database company scrubbed thousands of eligible voters from the rolls? Well now one of the co-founders of Database Technologies is back in the headlines -- he's working with law enforcement agents in Florida to create what may soon expand into a national surveillance system. We talk with privacy expert Wayne Madsen, investigative reporter Greg Palast and a top intelligence official from the state of Florida.

When is Joe Six pack going to wake up to the fact that in secret the government has conspired to create a dossier on every citzen in this country and this is who they hired to do it:

Hank Asher then creates the MATRIX as a state level network version of the TIA office. Essentially continuing the TIA office, but freeing it from congressional oversight and federal whistleblower protections. He admits smuggling millions of dollars worth of cocaine in 1981 and 1982. Coincidentally at the time when the Iran-Contra dealings were in full swing.
But this is only speculation. Could there be more of a link between illegal dealings between Hank Asher and the republican party? OF COURSE THERE IS!

In 1992, Asher founded Database Technologies, which later merged with ChoicePoint. In 1999, he founded Seisint Inc. by merging two companies. He is still on Seisint's board of directors, and continues to play an active role in the company.During the 2000 presidential election ChoicePoint, gave Florida officials a list with the names of 8,000 ex-felons to "scrub" from their list of voters. But it turns out none on the list were guilty of felonies, only misdemeanors.

So there we have it. We went from having a domestic spying agency run by a five time felon to having the same domestic spying program sans congressional oversight and whistle blower protections run by a convicted drug smuggler who has proven that he'll break the law to further the republican agenda.

http://www.oldamericancentury.org/oh_republicans .h tm

A Florida law enforcement data-sharing network is about to go national. In the name of counterterrorism, the Departments of Justice and Homeland Security are pouring millions of dollars into the system to expand it to local law enforcement agencies across the nation. It's called Matrix, which stands for Multistate Anti-Terrorism Information Exchange. According to the Washington Post, the computer network accesses information that has always been available to investigators but brings it together and enables police to access it with extraordinary speed. Civil liberties and privacy groups say the Matrix system dramatically increases the ability of local police to snoop on individuals.

http://www.democracynow.org/article.pl?sid=03/08 /0 7/1427223

The Florida company that built the database was founded by the man behind ChoicePoint and Database Technologies. The companies administered the contract that stripped thousands of African Americans from the Florida voter roles before the 2000 election.

Although narrower in scope than John Poindexter's controversial Terrorist Global Information Awareness program, Matrix may serve a similar purpose because it provides unprecedented access to US residents regardless of their criminal background. And states are eager to participate in the new program. On Tuesday, the Department of Homeland Security announced plans to launch a pilot program in state law enforcement data-sharing among Virginia, Maryland, Pennsylvania and New York.

Re:Remember the Florida election of 2000 ?

[greenplato]

During the 2000 presidential election ChoicePoint, gave Florida officials a list with the names of 8,000 ex-felons to "scrub" from their list of voters. But it turns out none on the list were guilty of felonies, only misdemeanors.

I don't believe that this is entirely correct. According to Palast's book there were many scrubbed felons that had their voting rights reinstated either by Florida or another state where they committed their felony. This fact was conveniently ignored when the scrub list was created.

I'd love to see some citations concerning some of the other allegations, but this post, modded informative, is nothing more than cut-n-paste .

Please cite your sources if you would like to maintain any respectability.

Re:Remember the Florida election of 2000 ?

[brighton]

OK - long story made short, I live here in South Florida and was looking for a job sometime in the fall of 2001. Seisint placed a wanted ad on monster for a Unix Systems Administrator.

I sent my resume and never got response back from them. Being unemployed, and having a little time in my schedule, I started doing some nmap probes (just regular tcp scans) on their network. It was mostly curiousity at first, but I was shocked at how many open ports and machines were sitting there on the internet. Sure enough I found a Windows box with file-sharing on. Curiousity got the best of me, and I tried accessing the 'C$' share on this box with "Administrator" (nopassword) . It worked.

Okay, so as it turned out this machine had cuteftp installed on it, and the user had the passwords to his ftp sites in a (quasi-encrypted) file. I don't remember the file name, nor do I remember the version of CuteFTP they were using, but there was a cheap script-kiddie type program I found that 'decrypted' the passwords in this cuteftp file. (It took no time at all, cuteftp probably used something really stupid like XOR..) I found this user's passwords to something like 8 production oracle servers in that file. (The password was the same on all boxes - and I remember the user names being a little different , so for all I know root on those boxes was the same as all the other passwords)

Not wanting to cross any further boundrys than I already had, I figured I'd send my findings to Seisint, and see if that got them more interested in my application. In fact in had! They wanted to talk to me and hear more about what I had to say regarding their network - For a number of reasons (I decided to go back to school mostly) I declined and told some dude from the IT department over the phone the whole story from above. In hindsight , I was lucky they didn't get federal investigators involved (back then there was no homeland security! Nowadays I could be labeled a terrorist) .

Yeah I know this is slashdot, and you all don't know me from shit, but I have the old emails somewhere I think. If anyone ever needed them for anything, I would go back and look for them. In all of this, I believe most of these large data repositories have shockingly poor secuirty procedures, I'm shocked there aren't more thefts like this one happening on a regular basis.

Re:Remember the Florida election of 2000 ?

[dbIII]

Hank Asher ... smuggling millions of dollars worth of cocaine in 1981 and 1982

John Poindexter's controversial Terrorist Global Information Awareness program

How do these people every get back into positions of responsibility after being convicted of serious crimes? Wasn't Poindexter selling weapons to a terrorist group that had declared war on the USA? Didn't he destroy evidence (which was backed up elsewhere)? How does someone like that get put in charge of an anti-terrorism group?

It doesn't matter which party is in, they should still attempt to run the country properly - forget the us and them bullshit and giving money to your freinds, just run the country according to the laws of the land.

Re:Remember the Florida election of 2000 ?

[watermnp]

If anyone ever needed them for anything, I would go back and look for them. I would be interested in copies of these communications if you still have them (my e-mail is public). Drop me a line and I'll explain why. Thanks!

Re:Remember the Florida election of 2000 ?

[Anonymous Coward]

Hank was never convicted. By the time that information was public, the statute of limitations had expired.

Re:Remember the Florida election of 2000 ?

[Anonymous Coward]

Oh, yes the republican plot...

"Asher has also given more than $500,000 to Democratic candidates since 1998."
Article

Re:Remember the Florida election of 2000 ?

[willwarner]

"I believe most of these large data repositories have shockingly poor secuirty procedures, I'm shocked there aren't more thefts like this one happening on a regular basis."

How many get reported?

Re:Remember the Florida election of 2000 ?

[Anonymous Coward]

yeah we laid off ALL the good security in America at all the companies THAT REALLY NEED IT, so who do you think they will work for now. The next Pearl Harbor may not be the way we remember the first one, please beef up security in this country or we are doomed.

Copycriminals

[Doc Ruby]

What's the difference between a "legitimate" business that uses my personal info without my permission, and a "criminal" one? Just the law, and perhaps the degree of abuse in which they engage. Today's legit biz is tomorrow's spammer - and sometimes the reverse.

All this info must be protected by copyright. I transfer a copy of my personal info to a receiver in a specific transaction, with the right to copy it only as required to complete that transaction, unless expressly allowed otherwise. When they "share" it with other parties, or retain it beyond that transaction, they're violating my copyright. As would any further distribution beyond their organization. They're all a bunch of criminals - we need catastrophes like these to be legally documented in violation of our rights, our copyrights, and remedied as appropriate to the damage.

OT

[Anonymous Coward]

"Whiny" wasn't a specific example, just general hyperbole. I've seen several such cases won by plaintiffs in Britain and they've all been for things that seem to me unremarkable.

Re:OT

[Eric Smith]

Yes, but my point isn't just about "whiny". If it's data that can be gathered about you in public, not due to any unintentional lapse of privacy, then it isn't private data, and wouldn't be subject to my proposed ownership arrangement.

For instance, a random entity shouldn't be able to find out what insurance carrier and plan I use. But if I post to Usenet that I subscribe to the Blue Cross HMO plan, then I would no longer be able to assert that as being private data that I exclusively own.

Yeah, thank goodness only AUTHORIZED third parties

[loggia]

...can see your social security number, your credit report, your addresses...

...anytime they want...

...um...

...whew?

The powers that be....

[skids]

....have similar problems of their very own.

It was CHINESE triads, AP reports

[Anonymous Coward]

It was CHINESE triads, AP reports.

Re:It was CHINESE triads, AP reports

[Anonymous Coward]

No it was Saddam and his WMDs and extremists.

Re:It was CHINESE triads, AP reports

[Anonymous Coward]

No, it was Gwen Stefani and those toothpicks she calls legs. Egads! People with skinny-ass legs should cover them up!

Contact them...

[chocochip]

Let them know what you think. Ask if your information was compromised. Make them feel the pain!

Contact Link

Re:Contact them...

[emptybody]

I filled out the form.

Category - Affected Consumers.

I would like to know if my personal data was compromised during your recently discovered - or any other known - security breach.

Thank you.

Re:Contact them...

[Anonymous Coward]

And, now your IP number is in their database too.

Prediction: You will never get an honest and complete answer.

were only californians notified...

[museumpeace]

because only california has a law requring such notice? What I mean is: Aren't there people outside of california whose personal information may have been taken?

Where's the Upside?

[LighthouseJ]

I RTFA and it says that ChoicePoint aggregates my information and sells it. I interpret "aggregates" as it crawls through and acquires my personal information without my knowledge. I never signed anything saying ChoicePoint can keep and handle my information how they see fit, nor did I receive anything that says some company has my information so I know. Am I alone in saying that no company should be able to profit off of my existance? If that's not bad enough that ChoicePoint has made a living selling my information of which I won't see a dime, now criminals have my personal information and now I have to stay on guard to see if the criminals do anything notably bad in my name.

This whole companies' existance and screwup just stamps out all notions of privacy I had, now not only theives profitted from me without even notifying/asking me, but now criminals can benefit from my existance too.

Re:Where's the Upside?

[_randy_64]

For some more info on ChoicePoint, check out this article from a couple months ago in the Washington Post. I was surprised it was seen here on Slashdot too. Gives a little more background on what they do and how they do it.

Re:Where's the Upside?

[LighthouseJ]

Good article, it's pretty scary how they can buy up everything and combine it all, it has the stench of anti-competitive behavior to me.

I've always maintained that I as a citizen should be able to see all records the government has on me, and also any companies like ChoicePoint that provides information on me to the government in which they use. Without knowing what the government knows about me, I feel like a sheep. My government works for me, not monitors and "handles" me.

Re:Where's the Upside?

[Anonymous Coward]

Newsflash: most companies are there to make profit off your existance.

Re:Where's the Upside?

[Fazlazen]

Ok, I'll take a stab at this one. Suppose for a minute that there were some sort of legislation that prevented companies from crawling through information about you and selling it.

Therefore, we would get rid of credit scoers. How would you propose that someone would be able to make a decision about offering you a home loan of 3 times your annual salary? If the information of your past credit accounts and payment history were unavailable, what would you recommend as an alternative?

I'm not trying to troll, I am just interested in how you would solve the problem.

Re:Where's the Upside?

[hyfe]

Am I alone in saying that no company should be able to profit off of my existance? If that's not bad enough that ChoicePoint has made a living selling my information of which I won't see a dime, now criminals have my personal information and now I have to stay on guard to see if the criminals do anything notably bad in my name.

Heya, We agree with you; come to Europe! We actually have laws protection your personal data, and prohibit the trading/sales of them.

In my opinion, stories like this go a long way of showing how fundamentally different the underlying differences between europe and the US are, especially the concept of "freedom". And I don't like your version at all:
"America, all the freedom you need to be screwed over, hard!"

Re:Where's the Upside?

[LighthouseJ]

I appreciate your comment.

I'm not saying a company shouldn't have my information at all, I'm just saying that if a company (or government agency) has a file on me, I should know what it says. Maybe expand the Freedom of Information Act to personal information.

Re:Where's the Upside?

[Fazlazen]

Under the FCRA, you are entitled to a free copy of a report of your "file" once a year from companies which are hosting FCRA-covered data. We had to implement this where I work.

Re:Where's the Upside?

[mink]

If said companyis making money off of our data, I think as the originator of that datapoint I should get a cut of the action.

Before you OH NOE, there's a solution.

[Anonymous Coward]

http://www.privacy.ca.gov/financial/cfreezeon.htm
It's heavy handed, sure. You're effecitvely DOS'ing yourself, and things may take longer to open windows, etc.. But better safe than sorry.

Re:Before you OH NOE, there's a solution.

[PitaBred]

Pay $10 for the fuckers to freeze the info they have about me? What the hell?

Re:Before you OH NOE, there's a solution.

[Anonymous Coward]

Buddy! Take it easy. You blew a gasket??!!!??
Yes, I'm the same AC who posted parent.
I agree with your assessment, but it's short sighted:
$~10 per agency, need three agencies, and need to send certified mail for at least two agencies.
So, total ~$50-60 per person. (no piggy backing on cert mail with two applications).
It's the price you have pay to have to DOS yourself :)

defense?

[Maskirovka]

Apparently the only defense against this kind of thing is to have really bad credit.

Re:defense?

[ilmdba]

the chewbacca defense might also work. hard to tell though.

Re:defense?

[gabba_gabba_hey]

I knew that being a total fuckup would pay off some day. Hooray!

Lets all laugh at security

[Toloran]

I used to work at a mortgage insurance agency as a temp doing data entry. I would see 100 or so SSN a day. They don't track who enters what data so I could of easily wrote down a few SSNs along with the person name, phone number, address, etc without anyone knowing I had done it. Even if they make extra-super-duper-sure that they people accessing the information are legit, there is absolutely no assurance that the person handling your information is honest.

Re:Lets all laugh at security

[fimbulvetr]

This is a bit different though...Take my parents as an example. They don't use credit cards, they own their cars and they don't even order pizza over the phone. If their identity was stolen and they recently refinanced, it'd be pretty easy to do the rest of the investigating from there.

For the choicepoint story, however, you and I didn't do anything. We didn't hand over our SSNs recently, we didn't buy a book online and we haven't lost our wallets lately. FWIW, although we should be concerned about how the information changes hands, we should also be very concerned for where our data sits day after day, and who has access to it.

A better solution

[nasor]

Rather than taking extreme measures to ensure that social security numbers are kept private, people need to simply stop pretending that a social security number is some sort of magic password that can be used to prove that someone is who they claim to be. SSNs should be treated about the same as phone numbers; assume that everyone has one, but also assume that everyone knows it.

"Law Enforcement Clearance?"

[bmasel]

"The firm was only given clearance by law enforcement officials to disclose the incident two weeks ago, Lee said"

Now why exactly would they need permission to tell me (if I were a CA resident) that I should be worried about my data being misused? The certainly didn't need any cop's permission to amass it, not to hand it to a "legitimate" customer.

Choicepoint also helped Bush attack US democracy

[plinius]

Greg Palast reported on it.

http://www.gregpalast.com/detail.cfm?artid=217&r ow =2
http://www.gregpalast.com/detail.cfm?artid=327 &row =2

Also see here:

www.electionfraud2004.org

You still think the "exploit" was an accident?

Snail mail campaign

[kybred]

Any lawyers out there want to draft a template letter that folks could send to ChoicePoint. The letter would be a demand that they remove all your personal info they have, since they have not shown that they can keep it secure.

Anybody? Anybody? Anybody? Bueller?

kybred

Re:Snail mail campaign

[base3]

Dear Consumer:

You weren't in our database. But you are now--thanks!

Sincerely,

Choicepoint Privacy Services

Re:Either that...or...

[symbolic]

...make companies that want to reap the rewards for harvesting and prostituting personal information, also bear the consequences.

One thing I'd have to wonder...what would a company like ChoicePoint be doing with someone's personal data(like Social Security Number), unless they had been explicitly authorized to have it? As far as I'm concerned, ChoicePoint might very well be the unauthorized third party.

CEO and CTO should be shot on CNN, live.

[Anonymous Coward]

that is all.

Data ownership

[EmbeddedJanitor]

The problem with this is that *you* don't own the data kept about you. You might have the right to view the data, but you don't own it. Since just about forever, various companies have been tracking various info about people (buying habits, credit history etc). They track these for their benefit (and their customers) - not yours.

When they lose the data, as far as they are concerned they have lost some of their business information (ie. someone accessed their data without paying).

That the data is about you, and could be damaging to you is incosequential to them. Anyone could have bought the data from them anyway.

Re:Data ownership

[shanen]

Actually, it's kind of a reverse technology thing... Not so long ago, almost all of the data about you was stored in your head, and if anyone wanted to know about you, they'd have to ask you questions. For the important stuff, they'd need to check your statements against the witnesses who were involved.

For example, before all this computerization, if you wanted to borrow some money, you told the bank about who you borrowed from in the past, and they would check to see what those people said about the loans and your repayments. You might claim to own a particular piece of land as collateral, but they would check with the property ownership records to see what was really going on.

Nowadays, you might try to borrow some money only to find out that some outfit like ChoicePoint has leaked your personal information, and someone used that data to "borrow" your identity--and now the bank thinks you've already borrowed twice that much. ChoicePoint says "Our data, our mistake, your tough luck." Even worse in the case when they helped disqualify legitimate voters because they were paid to do so... Reminds me of the joke about the "creative" accountant: "You want to know how much is 2 plus 2? Well... How much do you *want* it to be?"

I really think we should have the right to store our own data on our own computers, and if I heard of a country with that kind of law, I'd be thinking very seriously about moving. I really can't imagine that all of the personal data about me is more than the 250 GB of HDD I currently own. Possession is nine points of the law, as they say. If you need to check on me, ask me for permission, and I'll decide whether or not I'm willing to let you look at the data, and you better have a good reason. For example, you might want to check some of my (computerized) records before deciding whether or not to loan me some money.

Right now the data is "out there", somewhere, and no one really knows what happens to any of it. Even worse, the amount of recorded personal data is increasing very rapidly...

Re:Data ownership

[Vainglorious Coward]

The problem with this is that *you* don't own the data kept about you...When they lose the data, as far as they are concerned they have lost some of their business information

Which is why most developed countries have privacy legislation. "Ownership", in the context of personal information, is about the extent to which individuals can exert control over what happens to that data. Ownership doesn't (or shouldn't) reside with the business alone.

That the data is about you, and could be damaging to you is incosequential to them.

Which is why I support laws that make organisations take responsibility for the personal data in their custody. It's always puzzled me that the US, such a beacon of individual freedoms in most regards, is so weak in this area.

Re:Data ownership

[Anonymous Coward]

im not sure of this point system that the law goes by, but i believe possession is nine tenths (9/10) of the law...

Re:Data ownership

[Lisandro]

I don't know about the rest of the world; but Argentina grants it's citizens a consitutional right called "Habeas Data", which, in a nutshell, specifies that every individual owns his personal information and it can't be disclosed or abused without his consent. This includes medical records, bank accounts, work historials and so. Knowing that most modern constitutions are based on the US one, i thought something similar would be available to Americans.

It's usually paired with another consitutional right called "Habeas corpus", which ensures freedom of movement in the country and grants rights against detention without due process.

Re:Data ownership

[DrSkwid]

1/10th is 0.1 or a point, as it is known

ergo 9 points = 9/10ths

keep up

Re:Data ownership

[nasor]

Sorry, but that sounds like a terrible idea. What if a reporter learns that the president of the non-profit "Society for objectively studying the environment" used to be an executive for Evil Polluting Corp? What if a reporter learns that a politician has secret bank accounts where huge sums of money are regularly received? Is that information protected by your "Habeas Data" right? I certainly hope not.

Re:Data ownership

[Lisandro]

Sorry, but that sounds like a terrible idea. What if a reporter learns that the president of the non-profit "Society for objectively studying the environment" used to be an executive for Evil Polluting Corp?

Well, he's entitled not to tell anyone. People can change, you know. This can happen, but now the involved executive has the right to initiate legal actions.

What if a reporter learns that a politician has secret bank accounts where huge sums of money are regularly received?

In that case, he would most certainly be trialed, but the money in question wouldn't really be his - or atleast earned legally. A right comes with responsabilities; it's not an umbrella to break the law. A court would most probably decide the right doesn't legally apply. I'm not a lawyer in any sense, but that's pretty much how i recall it from school, were we discussed this.

See, the idea behind the right is to protect sensitive personal data. For example, a company can't investigate my medical background unless i let them to if they want to hire me. You can't go harvesting peoples' personal data like if you were collecting stamps because nowadays information is a valued thing, not tangible, but valued. Your personal information is as much yours as it is your car or house.

a blast from the past

[edward.virtually@pob]

here are links to the last time they were mentioned on slashdot and my comment on them at that time. these guys just keep getting slimier.

Re:No obvious notice appears to be on their websit

[fimbulvetr]

if it made it to /., black hats knew about it months ago...

So many are happy that our gvrmnt pushes....

[Anonymous Coward]

windows.
So many ciminals (read Al Qaeda), and so easy to get our information and our money.

So the funny thing here, is that if windows costs so little, what is the costs of break ins like this?

Re:So many are happy that our gvrmnt pushes....

[Saeed al-Sahaf]

Al Qaeda could never do someting like this, we have too many security checks. Al Qaeda? No, just spammers and thieves... And that 14 year old kid down the block.

Jail

[ewg]

Who is going to jail over this?

If the answer is "no one", then it will happen again.

Re:Jail

[Pig Hogger]

Who is going to jail over this?
If the answer is "no one", then it will happen again.

No, the proper answer is not "no one", but "no one of any significance".

Where do they get their data?

[Anonymous Coward]

Why does a customer company, even a 'legitimate' one have the right to gain access to information that, if improperly handled, will cost ME to fix the problem?

Where do these sick fucks get their data from? If their inputs were shut down the slimy bastards could be pushed out of business.

Part of the problem is that even my fucking bank can sell information to whoever they want to. There are NO COMPANIES in the US that I am aware of that I can actually trust with this level of personal information.

Which suggests a solution: If there were a bank or credit card company that was incorporated with the policy to NOT deal in personal information, and if they took appropriate legal measures so that policy could never be changed, they might be rewarded by a boatload of customers who are tired of this shit.

SSN is the real problem

[havarv]

The use of SSN as a PIN amazes me. The security relying way to much on the fact that no-one is suppose to have access to your SSN. If you get your SSN I can go say my wallet was stolen and you need to have new ID's made. Then get a stack of credit cards in your name. In a couple of days I'll be more you than you are. With so many people requesting to see you SSN in everyday life. This is a serious threat. My girlfriend was even asked to give up her SSN when she paid with a check at a grocery store because she was out of state.

Re:SSN is the real problem

[Anonymous Coward]

It is actually illegal for a retailer to directly ask for a social security number. They can ask for an identification number or a driver's license number, but not a social security number.

Re:SSN is the real problem

[Anonymous Coward]

If you think using the SSN as a PIN is bad for civilians, imagine how bad it is for the folks in our military. If flew B-52s for 12 years. When we prepared for combat sorties, we were supposed to sanitize (ie. get rid of any personal effects except our military ID.) The only problem with this is the fact that the military uses your Social Security number as your "service number." If captured, I was legally bound to provide name, rank, date of birth and service number... yeah, my social. With that information and a credit check, imagine the info the enemy could get about you. Where you have lived? What aircraft were assigned to those bases? Are you married? Imagine an interrogation with Yuseff threatening to tell his buds in the US to visit your house at ... All this 'cause the gov't got lazy. WTFO.

according to ChoicePoint

[a gremlin]

"In addition, ChoicePoint strongly promotes the responsible use of information as a fundamental plank of its business model, including strict standards regarding the use and dissemination of personal information."

"Protecting privacy is always a ChoicePoint priority. To underscore our fundamental commitment to privacy and our vision that good privacy is good business"

"This site only collects personally-identifiable information from you if you chose to provide this information to us."

"ChoicePoint does not provide personally-identifiable information to unaffiliated third-parties"

"Any communication or material sent to ChoicePoint Inc. or to the Site by electronic mail or otherwise, including any data, questions, comments, suggestions, feedback or the like, is, and will be deemed, non-confidential and non-proprietary. Anything sent to ChoicePoint Inc. becomes the property of ChoicePoint Inc. and its affiliates and may be used for any purpose, including, but not limited to, reproduction, disclosure, transmission, publication, broadcast and posting."

just thought id put some of the more interesting stuff here in one place...

Re:Choicepoint also helped Bush attack US democrac

[LittleLebowskiUrbanA]

Apparently they helped Bush steal your HTML tags as well.

Limits on personal information...

[Anonymous Coward]

The real problem is there's no public/private key separation. Your credit card number is a secret key, but must be shared in order to do business with it. Ditto for checking account numbers which make direct deposit possible. The reason boils down to sheer laziness on the part of credit issuers. When there's a problem they can soak the merchants and/or customers, so they haven't bothered to fix the system.

That solves your bank deposit problem. Public/private key separation would solve most of the problems.

As far as repeatedly entering addresses--come on, that's easy. Browsers have a wallet-like feature which fills it in on demand. There's no need for the provider (netflix) to store the information, and they should refrain from doing so.

So far as taxes are concerned--of course you have to give personal info for H&R Block to process them, but the grandparent means it should be treated as your property. You may leave valuables with a bank safety deposit box, but the bank does not own them. It is a steward. Its rights obviously don't extend to sharing information about what you've deposited with others.

Re:Limits on personal information...

[4of12]

Browsers have a wallet-like feature which fills it in on demand.

Excellent points, all.

My pet peeve is that "form filling out" information disclosure should really be kept to the minimum required for the transaction.

If you go into a doctor's office for an ingrown toenail, there's no reason you should have to dump down 57 pieces of data on a form. If I put down that I'm a 27 year old male with no allergies and I can digitally sign that I'm able to pay up to $500 for any services, that should be enough.

Likewise for getting an account at the video rental store, getting an airline ticket [cf John Gilmore's battles], etc.

Problem is, businesses and governments are addicted to the increasing TIA and decreasing the anonymity that was an artifact of older technology. People living the "free world" tolerate encroachment of their privacy without much thought. It won't be until a totalitarian regime (eg, China) starts using technology in new ways to suppress dissent and control the populace that people will become aware of the implications of putting so much information in the hands of the authorities.

Which reminds me - if you're a U.S. citizen, contact your Congressional Representative to eliminate the more egregious parts of the so-called Patriot Act.

Greg Palast

[Joseph_Daniel_Zukige]

seems awfully sure of his facts.

But I don't see his references in those articles. No links (and I know there are plenty of people who link him). Very few names.

I can sort of understand the lack of names, although it leaves me with questions. People do get scared.

But then he complains about HAVA, and he doesn't say why, except to wave his hands and say it's bad. He could at least put a link in to an article explaining the problems, even if he doesn't want to spend words in that article on the issues.

I can rant, too. But at least I can put a link or two in when it will help explain things.

The lack of explanation, even though I know HAVA was an exercise in how not to help voters, leaves me unconvinced on the other charges.

Do we really want change, or do we just want a bad guy to vent at?

If there's no explanation, charges are forgotten as soon as the TV catches the attention.

One more thing. This one hurts, but getting scared does not protect your rights. You look at the examples we have in the Ukraine and many other countries. People are putting their future on the line for freedom. But in the US, people want the freedoms without the costs.

Real freedom is not free as in beer.

Re:Greg Palast

[plinius]

He's an investigative journalist with the BBC. Journalists don't have to identify their sources. Furthermore before he was a journalist he was an investigator for the US govt looking into racketeering. The information that comes his way is often confidential documents.

I wish they all could be California laws*

[MillionthMonkey]

*although the Propositions usually suck

That is not an excuse. The fact that you happen to live in another state doesn't mean they have less of an obligation to you.

Of course it does. ChoicePoint's obligations in this matter extend only as far as set forth by state and federal law.

Now I've been told many times by people on Slashdot who don't live in California that I must be a pinko commie because I live in California. Us pinko commies here like to push corporations around with strange socialist-style laws, creating obligations for them that simply don't exist in more enlightened areas of the country that enjoy what the guys at CATO call "economic freedom".

For example, we make people print weird things on cans about stuff known to our state to cause cancer- a subject on which California appears to be some sort of an authority. (If other states know what's causing cancer, they're sure keeping it a secret.) And if ChoicePoint compromises your personal information, California forces them to tell you. Apparently in other states it's none of your damn business unless you're an employee of ChoicePoint. Or maybe a customer- if ChoicePoint is smart, they'll recognize the business opportunity here. I bet plenty of people in the other 49 states would be willing to pay to know whether ChoicePoint gave crooks their data or not.

If you don't live in California, there is always freecreditreport.com. It has a 30 day free trial. /schadenfreude

Look at the bright side. If you don't live in California, you're far more likely to pay less than a half million for your house, so your credit doesn't need to be that shiny anyway. If a few Russian mobsters get your personal information, you're probably still better off than the average California home-buyer. And once you buy your non-CA house, you'll only pay your own share of property taxes- you won't also be paying them for all your neighbors on the street who voted to make themselves a landed gentry years ago with Prop 13.

Just how info do they have?

[Anonymous Coward]

When one of the "contact us" options is "DNA Identification and Testing" it really makes me wonder just how much information they have on individuals.

Google employess gave all $$$ to Democrats

[Anonymous Coward]

Does that mean Google Management are FAGS or just TRAITORS?
Me I'm bettin' BOTH!

Good and bad

[earthbound kid]

In the short run, of course, a lot of people are going to be burned by this. But it could have some positive effects in the longer run. Once it becomes clear that using Social Security numbers as a form of ID is asking for trouble and that any information given to marketers is bound to be 0wned eventually, we'll start to see some legislative and commercial movements away from the current monolithic data hoarding. Right now, no one wants to endorse the right to privacy, since it "helps terrorists" and "hey, YOU have nothing to hide, right?" but once people realize that identity theft can effect them, we'll start to see some change. Hopefully.

ChoicePoint recklessly inept all along

[Anonymous Coward]

2 years ago I changed jobs, and my new employer used ChoicePoint for a background check, including references. One of my former coworkers was befuddled by the awkwardly worded request ChoicePoint sent him, and forwarded it to me. I was appalled when I realized that they're sending out reference requests with an email template that puts the SSN in the subject line, making sure that it gets logged for posterity who-knows-where.

I don't think they're evil, but they certainly don't seem to have any hint of appreciation for the sensitivity of the stuff they collect. HIPAA on them!

Now They Have Even More Information

[obidonn]

Now you've generated more data for their profile of you and informed them that you follow links off of Slashdot. Good suggestion!

ChoicePoint's new TV ad

[fireman sam]

Open: An underworld type figure is going through several folders of information. Credit cards are all over a large oak table.

He looks to the camera.

UWF: "ChoicePoint is my point for all your information"

Voiceover: "ChoicePoint, looking after number 1, itself"

Individual keys, encoded data on 3rd party systems

[tentimestwenty]

This has probably already been devised but this could work via a kind of key where the system on the other end would only know the individual key pertaining to your computer. The data would be read out, encoded and stored on the remote computer encoded. If you assigned a unique key, revolving hardware keys and perhaps an optional user password there would simply be so many varieties of encoding that it would be hard to break all of them for every person's info. Even if the keys were simpler the time to crack the millions of simple keys would certainly slow or make ineffective the stealing many peoples' information.

Scary

[Anonymous Coward]

This is not surprising to me, as an employee of a recent ChoicePoint acquisition company. They've acquired 50 companies in the last few years and I'm surprised that they even knew that there was an intrusion. Most of the people that I have met from ChoicePoint are dimwits, and don't get me started on that republican-puppet Derek Smith. However, this is insignificant compared to what they did to rig the 2000 election. Derek's motto is "[you] have the right to privacy, but non anonymity." What a load of shit.

No Offense..

[TubeSteak]

No offense, but wasn't everyone doing a little bit of Cocaine back in the 80's?

I mean come on...
[sarcasm] typical liberal hysteria. [/sarcasm]

+1 Funny or not at all

Just get a new identity

[HermanAB]

http://www.anewidentity.com No big deal...

Companies subject to FACT Act?

[thpr]

So given that ChoicePoint recognizes that 3 of its subsidiaries are subject to the FACT act passed in 2003, does anyone have a comprehensive list of companies that are subject to the act?

I know the big 3 (Experian, Equifax, TransUnion) and being able to use annualcreditreport.com, but didn't know ChoicePoint was subject to the law (but after this, will be sure to get a copy when September rolls around). Any others people are aware of?

Hahaha, some douchejob got his Xanga hacked.

[Anonymous Coward]

His password is 'rapala', FYI.

Re:Hahaha, some douchejob got his Xanga hacked.

[Anonymous Coward]

Mod parent down - the site opens up a metric ton of pop-up windows and a... shall we say 'choice' sound clip.

Re:Hahaha, some douchejob got his Xanga hacked.

[Anonymous Coward]

Not in Firefox it doesn't...

Re:No obvious notice appears to be on their websit

[Anonymous Coward]

When will people get it, security through obscurity doesn't work.

Legal Recourse??

[micron]

Is there any legal remedy in the United States for this?

From what I understand, credit agencies cannot be held legally liable for false information in your credit report.

Also, there is no legal requirement for these agencies to keep your data about you secure. They do it for PR reasons, but that is about it.

The EU has some laws protecting consumers from this crap. I understand that the FTC is doing some work in this regard, but nothing yet.

Anyone have more details on this?

If we could hold these agencies criminally liable for these events, I would expect that 1) credit reports would be a lot more accurate and 2) companies like this would not exist due to the liability of having this type of information being too huge.

Re:Legal Recourse??

[Teancum]

IANAL. (full-disclosure) I do know, however, that there are anti-identify theft laws and businesses that through neglect contribute to identify theft can be held liable for damages resulting from that theft of information.

The major problems are:

1) You are indeed a victim of the identify theft (not something you necessarily want to have happen to you). Merely the potential to become a victim is not enough.

2) You have not been notified that you may be a potential victim of identify theft from an action that the company is aware of occuring.

3) Even if you have been notified, you must take reasonable steps (changing bank accounts, putting a hold on credit cards, ect., all at your expense) and problems still occur.

----

I would have to agree that these consumer information bureaus should be held to some potentially high liability standards should the information they possess get to people who use it for fraud or illegal purposes. Laws that govern the collection of personal information into databases should be as strict, generally, as credit bureau regulations, particularly if that data is in turn sold on a commercial basis (such as /. selling the subscriber e-mail lists to a bunch of spammers). The problem is that people involved with collecting this information (like grocery stores and the "club discount cards" or even a telephone opinion survey... they got your phone number and usually name if you answer the questions even if you don't directly tell them) are very sloppy with the information that they collect, and if somebody offers even a very modest amount of money they are willing to share just about everything they have collected, with basically no strings attached.

If these businesses who have personal information had liability issues to worry about, they would be more inclined to get rid of personal user information as fast as they could, unless it was a critical function of their business (like billing records). And even then that information would be a guarded secret like most reasonable people expect that data should be kept. Mind you, this is a totally seperate issue to wheither the government should maintain databases on individuals, but rather governance of databases by private companies.

LexisNexis Group

[Anonymous Coward]

Holy crap. My school (as I'm sure a lot of other universities) subscribes to LexisNexis Academic. That database indexes newspapers and news magazines. I had no idea they kept a database with ME in it!!
eep!

Kevin Mitnick

[Space_Soldier]

I thought that Kevin Mitnick wrote a book and created a company that is supposed to prevent this type of actions. One the following things seems to be wrong:

• His words are a bunch of bollocks.
• His company is a failure.
• Companies don't know about him.
• Companies don't want to enter in a contract with a convict.
• Companies don't give a damn.

I hope to read his book when I have free time. If you /. readers know something, fell free to replay to my comment. But if his words are good, then the idiots that let this happen should be fired for dereliction of duty.

Re:Kevin Mitnick

[Anonymous Coward]

The art of deception? [I make no money on this link] I read that book, about social enginering and stuff [good book, read it] well anway, Companies don't give a damn, regardless of if any of the options are true. They will not have to wait long for people to forget and currently identity theft is not a very common hot topic. When it matters more than janet jackson's actions in that one superbowl, then will the people respond. [Until that happens the laws will not change, and change will be resisted by corporate lobbists because it costs them money to provide such guarntees]

Re:Kevin Mitnick

[kliment]

rather good book. finished reading it yesterday. it seems however that the book implied companies that consider their own data valuable would take the described steps to protect it. Nothing was mentioned about laws to handle this kind of data

Re:Kevin Mitnick

[mink]

Janet Jackson took no action that was part of her breast being exposed.
A individual person who was not Janet Jackson chose to use his own hand, reach over to her and remove part of her outfit.
Everything anyone complains about should be on his cracker ass. Janet may have agreed to the stunt before hand, but she also seemed rather suprised on stage, so maybe it was a plan she was not in on.

Well, at least ChoicePoint has "some" filters

[drDugan]

...there are others simply grabbing your data and SPEWING out on the web for all to take.

check out http://www.eliyon.com/.
Not ssn and mother's maiden name, but equally as disturbing to me.

Re:Well, at least ChoicePoint has "some" filters

[teknomage1]

Doesn't seem to effective. I have a rather unusual name and they don't have any info on me or my father, or brother with the same name. Looks more like hype.

Re:Well, at least ChoicePoint has "some" filters

[gvonk]

Hahahaha...
I guess they don't do a lot of filtering for middle names.

Mr. Rob Cmdrtaco Malda
Founder (past)
Slashdot company

Time for action

[Anonymous Coward]

Looks like it's time for a major class-action lawsuit. Any lawyers out there want to get rich and retire in style? Here's your chance.

Where?

[Anonymous Coward]

Mass state uses your social security number ON your license? Sheesh, sorta makes not carrying around your social security card a mute point.

It needs to be treated as what it is:

[Sycraft-fu]

An identifier. An SSN is an ID, not a verification. It is useful because there can be, and are, collisons of names, which is the primary method of identifying someone. So you take a name + an SSN and there is nearly a zero chance of a collison (even more so if you add a birthdate). As you note, however, it needs to be assumed that this is known, is public. I wouldn't attmept to use my name to verify my identity, why would I use my SSN?

Companies need to get on the stick and use other verification measures. Using an SSN as na ID # is fine, not as a password, that needs to be something else not related to identity.

Re:It needs to be treated as what it is:

[jelle]

Tell that to the banks and lenders, because that is where the problem lies. They see simple knowing the SSN and other trivialities as a proof of identity.

What 'the SSN' needs is a 'cryptographic challenge system' where you kan keep your real SSN fully private, and can hand out numbers that prove your identity to people who wish to verify who you are, and that at the same time prevents the use of that number that you gave out to prove identity to a third party.

Asymmetrical cryptographic algorithms such as RSA allow that, and a simple calculator-type device and/or smartcard allows people to do the above safely and securely, to the point where you need to be personally robbed of your smartcard and pin number and/or password before you have any risk of having your identity stolen.

If such a system were used instead of plain SSNs, the stolen choicepoint data would only be bad because of the detailed and verifyable information about the victims in the data, but the data would be useless for impersonating the victims for anything such as getting loans/mortgages.

It's an extreme measure, but it's a widespread problem as well: Maybe it is time for liability with regard with such sensitive data and/or simple outlawing many of the current common uses of 'the SSN' as an incentive to the industry to embrace a system where the people don't have to worry about others impersonating them into financial ruins.

Re:It needs to be treated as what it is:

[Teancum]

The problem here is that the SSN (Social Security Number) is just an "account number" that has been heavily abused.

The fact that the number is legally unique (it is illegal to apply for more than one SSN...and verified that you havn't recieved another one by the Social Security Administration), and widely used (you must have an SSN if you work in most jobs in the USA, and also if you pay taxes to the IRS) make it a very useful identifier. Because of this, it is also used in other U.S. Federal Government organizations like the Passport Bureau (forming part of your passport ID number) and by the military for the identification number required by the Geneva Convention (replacing the military serial numbers issueed during WWI and WWII).

The problem lies in the fact that too many people (including the IRS) use the SSN for things that they shouldn't. Banks are required by law to ask for an SSN due to tax reporting issues. The problem here is that the bank then links the SSN with other information to that SSN rather than just your name, because they don't want to bother with a unique customer identification number. As pointed out in the previous post, it is an identifying piece of information like your name or birth date to describe you as a unique individual. It is not a way to identify that you are who you say you are.

That really is the clinching thing here. How do you identify that you are John Q. Public with SSN# 555-55-5555 born July 20th, 1969? (or any other similar set of identifying figures) I may be able to provide a full set of information that Mr. Public would know in his lifetime, but all of that can be researched to some extent or another.

A picture ID or other biometrics like finger prints or DNA are useful because it can be used to establish that at the time the identification device was created the person who issued it had a strong reason to legally believe the other information on the ID device is correlated with the biometrics information.

While that information can be useful because it is difficult to fast talk a DMV officer that you are somebody other than who you really are. Still, even that can be defeated through social engineering methods just like any other social hack.

The only "fool proof" system would be to take a DNA sample at birth, tied into the SSN application also done at birth, and even that has problems with identical twins or clones.

The #1 problem with all of this paranoia over identification is that biometrics data is very difficult to transmit electronically. State Legislatures (with strong lobbying from banks and other businesses) have passed laws to permit commercial transactions electronically and there are efforts to make the information transmitted in binding electronic tranactions (like a purchase on E-bay) simple to perform. In addition, the identification verification must be done with an automated process, and advanced AI architechture generally isn't available, nor legally required, to compare biometrics data to confirm you are indeed the person you claim you are.

So how do you confirm identify in an electronic arena? Crytographic methods are much more secure in the sense that if your identity has been previously decided it can be used to say the cryptographic ID has been used consistantly by the same individual for some period of time, and has not been reported as compromised. This can stop some classes of identify theft, especially since most people who steal a credit card and other related items only use them for a short period of time.

In short, using a SSN in a way other than as you would your name is just silly and should absolutely never be used as a password. Banks and other organizations should simply treat the string of characters that is your SSN as if it were another part of your name.

Re:It needs to be treated as what it is:

[Jahz]

Who really uses the SSN as verification anymore?

I cant get a passport or drivers license/state id using it. My online stock firm uses parts of it to create a temporary password if I forget my login info. My university uses it as my student ID. However, nobody has ever asked me for it as verification.

I think we are missing the point. There is NO way to truly verify the identity of an american citizen. To get my passport last week, all I needed was a 20-year old peice of paper with a barely visible raised seal (birth certificate) and 80 US Dollars. With that I provide the same SSN that is on the birth certificate and viola... instant international identity papers.

I would rather the government did not have my DNA on file, but that seems like the next-best solution.

Re:It needs to be treated as what it is:

[jelle]

"Banks and other organizations should simply treat the string of characters that is your SSN as if it were another part of your name."

No, they don't. Ever looked at a credit card, or line of credit application recently? They treat it as the password when accompanied by a name and date of birth.

And that is the whole reason why it's dangerous if other people know your SSN, because some bank you never did business with assumes it's your password.

Re:It needs to be treated as what it is:

[Teancum]

Thanks for clarifying that.

One of the casualties of this mis-use of SSNs and birth dates is that it is now incredibly difficult to obtain birth certificates, and a depreciation of birth certificates as documentation of citizenship.

I also think it is incredibly stupid to have SSNs issued at birth... indeed you have to apply for them at the hospital when you are signing the discharge papers, and are usually processed jointly with the birth certificates now. Very different than when I got my SSN (which was when I was 16, and that was because I had to fill out a W-4 form for a new job... to pay Social Security taxes).

I do think we are on the same page here for what should be done, and why banks are being stupid legally for using a SSN as a password. Evenutally it will catch up to banks, to their demise.

Put the slashdot effect to good use

[Omega Hacker]

Everyone reading this story should take a few minutes out of their day and call ChoicePoint, and ask them a few, um, "point"ed questions. According to their page at http://www.choicepoint.com/privacy.html you can call them at 1-877-301-7097. Call them up, take some of their precious time (they're taking yours, it's only fair) and phone bill, and ask them directly if your private, personal information was involved in this theft. I'll be doing so tomorrow, and making as much of a pain of myself as I can. Supervisor, here I come!

Re:Put the slashdot effect to good use

[Anonymous Coward]

while we are at it... file complaints at www.truste.org/consumers/watchdog_complaint.phpURL :www.truste.org/consumers/watchdog_complaint.php)

Re:Put the slashdot effect to good use

[ubertemp]

For those of you feeling especially lazy, feel free to copy this and send it off to consumer.center@choicepoint.com

I just read the MSNBC article, http://www.msnbc.msn.com/id/6969799/, about how large quantities of personal information were stolen from your databases and became concerned. Therefore, as I am not a resident of California, and thus you will not voluntarily be informing me of whether I am affected, I would like to request that you provide me with assurances that my information was not compromised.

If I do not receive a response from you within a week I will be contacting my lawyer and asking him to pursue this matter further.

Thank you in advance for your cooperation

File under I for Irony

[!emus]

The first paragraph in ChoicePoint's Fraud Prevention Solutions page contains this amusing excerpt: "ChoicePoint's primary goal is to help speed and ease the research process and provide resources ... in order to prevent fraud..." It's amazing how removing just one word from this sentence yields their ACTUAL business practice.

Cocksuckers

[Le Marteau]

Their website. The link to "Latest News" "Record Revenew"

What could be more telling. NO, ASSHOLES, that's NOT THE LATEST NEWS.

If one ever needed evidence of the lying, cheating, dishonorable aspect of American Capitalism, this is it.

Dickheads. Suspender wearing, Blackberry toating, power lunching, lay-offing, ass-kissing, pro-activly cocksucking DICKHEADS.

I can't stand it any more. Where's my Prozac (TM)?. These fuckwads are hurting my buzz.

You forgot one thing...

[PaulBu]

How would THEY take the transaction tax off?

Otherwise, perfectly described Swiss bank anonymous account... "But think about the CHILDREN!"...

Yes, tehre are technical means, and then there are financial/political "considerations". I wish it would happen ike you describe, but, really, a snowball chance in hell it will, agreed? ;-/

Paul

Contact your state attorney general's office

[Anonymous Coward]

Demand to be informed. Find your SAG's web site: http://www.naag.org/.

If I was affected...

[thoughtlover]

could I sue them? And on what grounds? Negligence?

Really, there need to be hard rules (I hate the word 'law', but essentially it's the same) made for companies that hold personal information in digital form. Databanks on their intranet shouldn't even be connected to the internet, but in this case, it wouldn't have mattered. Social-engineering did this? Man, what kinds of badges do they have for security there?

Candy badges might be slightly harder to forge than something printed on an inkjet.

Will you even get a notice?

[Stephen Samuel]

35,000 Californians will get notices because California law requires it.

The article points out that "Lee said law enforcement officials have so far advised the firm that only Californians need to be notified.", so I'm guessing that there are probably another 300,000, or so, nationwide who will not be notified by the company. A few other really high-profile types might get a notice, but I'm betting that no more than a couple dozen non-Californian SlashDot readers will get notices.

Does anybody else want to call and ask and see if they even get an answer? (I don't live in the US, so I probably don't count, statistically speaking.)

Re:Will you even get a notice?

[akadruid]

I think it's a fair guess that 300k US citizens have had enough information stolen to make them liable to financial problems.

Now, that data is going to worth a lot of money to someone. There are going to be individuals on that list who could have more $100k stolen each, ergo, the data is worth a multiple of that.

But what if someone leaked it? Disgruntled employees or clients, other blackhats, cleaners, anyone? How wide would a 100MB csv spread on Kazaa? Given the precedent set by spammers, nearly all of those victims could be exploited.

Anyone want to guess the political, economic and cultural impact of 1 in every 10 US citizens becoming bankrupt or even destitute in a matter of months? If it doesn't happen this time, its a ticking time-bomb for the future.

A radical redesign of the modern approach to financial security is overdue.

Re:Will you even get a notice?

[willwarner]

"300k US citizens"..."1 in every 10 US citizens" The US has ~300M people, so that's 1 in 1000.

Re:Will you even get a notice?

[Stephen Samuel]

It's even more interesting than that.

If Al Quaeda buys even a small piece of that they could steal the identity of a few hundred US citizens... and probably do it in a way that wouldn't attract a whole lot of attention. (most people aren't going to complain about their credit rating improving).

COmbine this with the US actually trusting ID to be accurate -- I mean, it's not like the 9/11 hijackers even bothered to fake their identity, anyways.

New business model?

[Anonymous Coward]

ChoicePoint and Axciom make money by selling data, right? If we compile all of the data on ourselves first, shouldn't we be able to prevent them from selling it to other people?

I believe that they think that all of that information has some value, and California believes that that information may harm the people that the information is about if criminals get ahold of it. If so, can't we make the case that all of that info really belongs to us, and that we might be harmed if a bunch of nit-wits get ahold of it and sell it to criminals?

It would make some sense to steal that information and make it all publicly available for free, and see what happens. The companies that 'own' it can't do anything but prosecute someone for B&E unless the information has a monetary value. If there is a monetary value, then everyone should be financally compensated for each 'sale' of their info to any other company.

One way, that I have considered...

[Anonymous Coward]

is to sue for inadequate protection and technical inadequacies. They are running Windows(BTW, do netcraft on all the reported breakins(such as www.saic.com) for the last year, quite the eye opener). It can be shown that Windows CAN NOT be secured. As such, it is a poor choice (in fact, one of the worse choices), that a company can make. Once companies are held accountable for picking a known insecure OS (otherwise, known as TCO), then companies will think twice about the dollar costs AND the potential legal costs if one or two of them are thrown in jail. After all, how is this any different than a bank using a safe made of paper? Would not the bank officers be sued for incompetience? and would not the bank be held accountable? Same thing.

Checking account info may be compromised too

[MacDork]

Why the hell are they allowed to keep a dossier on me if they don't have any mechanism in place to allow them to track how it is used and by whom? This is insane!

If ChoicePoint keeps tabs on your FICO Expansion score (Fair Isaac started selling this on July 27, 2004), then the "other information" mentioned in the write up probably includes your checking account information.

The EU example

[mbaciarello]

I'm sorry I don't have time to check facts thoroughly, but here in Italy, personal information does belong to the individual. I think this legislation comes from EU directives.

Basically, you don't own the actual © to the information being stored, but you own all rights to it, except what I'll call "commercial exploitation."

In other words, any company requiring you to hand over personal data (even just name and DoB) must publish a notice in which it officially states it complies with current law, and a legally-binding policy of use of the data (this is similar to the US, AFAIK.) Such policy, here, must include a document which specifies the security measures the company has taken to protect the data, down to a description of their IT systems and "practices," and/or a list of people entitled to access and use these data.

However, the difference is you may officially ask for removal or change of the information from any form of database the company may have, at any time. They have a limited time to comply, and you only need to send snail mail to exercise your rights.

For credit information, AFAIK Italy has a centralized, governmental database for those with officially bad credit (sorry, don't know the legal English term.) Not sure if you have the same rights over it. However, if any bank or commercial institution keeps a copy of the database (possibly with additional information), it must ask for the individuals' permission, and its database must comply with the above legislation.

This doesn't solve the problem of what happens if your data is stolen. However, it gives you the right to withdraw any and all information from a company if it doesn't meet your requirements for trust. Or again, it allows you to erase any and all information from the databases when you're no longer interested in the company's services.

Of course, the fact it requires you to send official snail mail discourages most laypersons from a thorough "personal data management." However, the possibility is there.

Re:The EU example

[mbaciarello]

This doesn't solve the problem of what happens if your data is stolen.

Small correction... This should read "this doesn't necessarily repay the individual for their damage." The company (actually, those responsible with data management) can be prosecuted if "privacy malpractice" is suspected.

I don't live in California, but...

[Skudd]

...I am quite unsettled now from this.

There's no simple solution to it, other than abolish technology.

Re:I don't live in California, but...

[frost22]

There's no simple solution to it, other than abolish technology.

I'm baffled by such a stupid and clueless statement. You seem brainwashed by the marketing industry.

Of course there is. Strong privacy laws with teeth, essentially preventing companies like choicepoint to amass such heaps of data in the first place (and thereby ruining their business). Have guiding principles like data avoidance and individual autonomy of data.

Write a Privacy Law with no concern for business marketing interests. Just ignore their whining, they will go away after bankruptcy anyway.

Re:I don't live in California, but...

[Skudd]

I'm baffled by such a stupid and clueless statement. You seem brainwashed by the marketing industry.

Quite the opposite, actually.

You claim stronger laws need put in place. Yes, in an ideal world this would be the answer. We don't live in an ideal world though. There's so much that can happen between "point A" and "point B".

Example:
Like with ChoicePoint, a criminal accesses large amounts of private data. Between the time they generate, for the sake of the argument, an SQL dump of it, SCP it off to one of their private servers in FooLand (immune to U.S. law), and when ChoicePoint actually realizes what happens and acts on it, nearly 5 minutes can elapse.

Slapping the hand of the criminal that did this, even if they were in the U.S., will do absolutely no good because the data has been moved to another country that the U.S. has no jurisdiction over and Mr. "Hacker" now has his bail paid for, as well as a rather decent kickback from his Fooian partners in crime.

Simply having this kind of data accessable from the internet is a huge security risk. If you think privacy laws can solve it, fine, that's your opinion. I don't see such a "fairy tale" solution happening though.

Re:I don't live in California, but...

[frost22]

The criminal must get his hands at those data first. In a place with strong privacy laws he will run into walls and walls and walls. Whenevere he wants to move someone is citing "privacy" and refusing hist requests. And, nobody will have that data in the first ölace, since they all delete every piece of data they don't have a demonstrable need for.

Beowolf Lawsuits

[Anonymous Coward]

So, 50,000 people file a class action lawsuit in federal court, but the Federal judge declines to hear it...

So 1% of those people (500) file independent lawsuits in 50 different states, each with different arguments and facts. The price of fighting them all could be horrendous.

Re:Beowolf Lawsuits

[MillionthMonkey]

This may actually be preferable to a class action. What you wouldn't want to happen in this case is for lots of people to sign their rights away (absolving ChoicePoint of future liability) in exchange for a check that arrives in the mail later to the tune of $53.47 or something that will seem inconsequential once your identity is stolen. Although depending on the egregiousness of the fault, the sum may be greater than that, and it may be in this case. But the point is moot- there will be no class action.

If this happened to me, I'd monitor my credit report closely and lawyer up personally on ChoicePoint's ass the minute anything weird showed up. Everyone complains that people sue too much. But when a corporation leaves your ass flapping in the wind like this, what other redress is there? We should be so lucky that individuals still have the right to sue corporations when they screw us over- things won't stay like this for long.

A perfect 419 scammer school

[Teancum]

My god... just what is that place.

I love this link on the the website you listed that refered to The University of Nigeria: Home of the Advanced Fee Methodology

This is just too good to be true...and it is.

Frankly, one of the best parody sites I have ever seen. Thank you, thank you for a good chuckle, and something I'm going to have to make sure gets spread around.

This is almost as good as the Microsoft Linux Distro Definitely a bookmark site.

Choicepoint/DBT have had many PR problems before..

[ant_tmwx]

As someone noted, Choicepoint/Database Technologies are the guys who were paid to scrub Felons from the Florida list of eligible voters before the 2000 & 2004 elections. If you live here you read about em in the papers constantly for shady activity, & they were in a few documentaries about the elections. They were paid an insane amount of money ($4 million no bid contract, see Jeb Bush, FL governor) for what they did, and did a horrible job in return. A few of the problems were they only matched parts of names, not whole names, gender, race, etc...so a black guy w/ a partial name match to a white felon would be unable to vote. This ended up disenfranchising thousands of black voters (frequently democrats) in the 2000 election where Bush only won by 500-600 votes in the state, which led to him winning the election.

Re:Downward Slope.

[Anonymous Coward]

The Pizza Joint Kid.
And. The Information Highway.

The Joys of the DPA

[Spad]

At least until Blair and Clarke finish butchering the law to suit their own agenda, this sort of incident occuring in Europe would be almost impossible. The Data Protection Act would prevent ChoicePoint from allowing anyone other than you (besides law enforcement, with warrent) access to your personal information without your explicit consent. For example, when I graduated last summer, I had to sign a DPA waiver so that the University were permitted to release my grades to any potential employers who wanted to look at them in the course of a job application. Of course, all the new government databases in the UK that tie in with our glorious proposed national ID card scheme will be exempt from the DPA, but everyone else in the EU is still bound by it.

Re:The Joys of the DPA

[t_allardyce]

I think in this case the data was stolen, not sold (at least that's what they say eh?) but the DPA would have some sort of compensation for that, or the company would be in shit for incompetence so that's their motivation to make sure your data is safe. I really don't understand this ID card exemption, it makes absolutely no sense - putting aside the arguments for and against ID cards for a second and just assuming they are a good idea, what possible reason is there to make them DPA exempt!?

Re:The Joys of the DPA

[Spad]

Easy, so that the government can do whatever they want with the data without having to worry about the constraints of the Data Protection Act.

Re:The Joys of the DPA

[t_allardyce]

Yes but whats their bullshit (ie public) reason?

Experian (in UK) also screws you : my experience

[fantomas]

Experian is a company in the UK (I believe they may be USian) that holds credit information, and is used by many UK companies to check credit records.

A few years ago I applied for a mortgage, and got refused because the bank did a credit check with Experian, Experian told them I wasn't on the electoral register, so the bank turned me down. I knew I was on the electoral register, and had been for years. I went to the local council for my previous residence, and the helpful council officer checked my record, and even let me come round the desk and look at her screen to see my record. I phoned Experian "I know I am on the electoral register for this address" (Experian) "no, sorry sir, this isn't on your record" (me) "I'm looking at my name on the electoral register, I'm just handing you over to the council officer who will confirm" (nice govt. officer): "yes, he is" (Experian "ahh... we'll look into that" (me): "cheers, I've been turned down already for a mortgage, are there any other parts of my credit records you should be checking?".

I really recommend that anybody in the UK who is about to buy a house/car/other significant credit transaction to ask for their records first. Which of course costs you money that goes into the credit agencies pockets. It's a corrupt system, and there's nothing we can do about it. Private companies running (ruining?) peoples' lives. "Sue the company" might be ok for you big shots but I was on low wages then and I'm a student now. One day I'll be working again and the first thing I got to do is use *my time* and *my money* to unpick *their mistakes*. Experian's mistake f*cked up my life, be wary people.

Basic principle of the EU directive

[CaptainZapp]

YOU own your data and not any halfwitted, slimebag company that happens to have it in one of their databases.

As a matter of fact, even supplying personal data to third parties is outright verboten without a solid reason to do so. (And no, money grubbing greed is not considered a solid reason, legally)

Re:Experian (in UK) also screws you : my experienc

[Xiaran]

As another UK resisdent I must express my surprise and, yes, shock that the local council was actually good for something :)

"virtually every citizen"?

[Kosi]

Does that mean that virtually every citizen gave them the permission to collect data about them, or that it is really legal for a company in the USA to collect personal data about people without their consent or even knowledge?

And what do they do with this data, they can't sell it, or what?

And how can one of those "virtually every citizen"s get all this data deleted when he wants?

LAW AND ORDER

[Anonymous Coward]

Why are there no laws governing the use and storage of people's informatio? We need an amendement (bill of rights) to the constitution that would protect individuals from any kind of intrusion on their privacy. I believe that if computers existed at the time of the creation of the bill of rights the founding fathers would have included something quite strict on the matter. Why don't the democratics pick this up and push it in congress, or have some hearings on the matter? Where is our country going? Is there no longer a statesman that want to protect individuals?

This is why...

[EmagGeek]

I keep fraud notices on my credit reports AT ALL TIMES. It is a slight hassle when I do want to open a new account, but that is so damn rare that it's worth the extra protection. I just wish the credit file locking option would be legislated nationwide.

Re:Yeah, thank goodness only AUTHORIZED third part

[Anonymous Coward]

Aren't addresses public...? Like, in the phone book and stuff.

Identity Clearinghouse

[Dachannien]

While I like the idea of other companies not being allowed to collect or share personally-identifiable information without my explicit written consent, I think a more important stopgap measure is for the government to forbid companies from permitting credit or banking transactions where the identity of the individuals cannot be verified. (It would actually be a more complicated setup than that one sentence, to allow, for example, you to transfer funds between a bank account and a brokerage account once you've been verified as the owner of both.)

I also suggest that the government operate an independent "identity clearinghouse" of sorts. The process would go something like this:

1. Consumer requests (for example) a new line of credit from Bank X. In the process, Consumer provides contact information to Bank X.
2. Bank X contacts Government's Identity Clearinghouse (ICH) with the provided contact information.
3. ICH (a) compares the provided contact information with that in their records, and (b) uses that contact information to contact the consumer and verify that the credit request was valid.
4. ICH informs Bank X of the validity of the credit request.

To fund the system, a small charge would be paid by the consumer, the bank, or both. Other more secure measures (such as personal appearance at a local office) would be involved in changing the information in the clearinghouse. The consumer would then inform their bank(s)/utilities/whatever of their updated mailing information, and the bank would then ask the clearinghouse to verify the correctness of that info.

Re:Identity Clearinghouse

[Vitamin P]

To fund the system, a small charge would be paid by the consumer, the bank, or both Yea right.... the bank will absorb the costs. What's next your going to tell me professional wrestling is real. What should happen is we have some checks and balances in the system. Right now if you have a blemish on your credit report it takes an act of congress to get something changed the credit agencies only let you change something because the law says they have to; the law doesn't say make it easy. I say change the law to make the "burden of proof" on the corporation not the consumer.

I *did* create it!

[theonetruekeebler]

The copyright on information belongs to the writer, not the subject of the piece

I created my address by purchasing a house and moving into it. I created my credit history by obtaining credit, using it, and paying it off (or not). I created my salary history by getting a job and drawing a salary. I created my education history, GPA, major, minor, and concentration by getting an education. I created this message. I created my marital status. I created my child, though they are creating original art of his own in the form of barf stains and poopy diapers. I created my driving record in the car I purchased (thereby creating a transaction). I created a trip to Alaska last year. I created the purchase of several souvenirs while there. I created a speeding ticket near Healey, though I will concede that the public has the right to know what sorts of idiots they are sharing the road with and place that in thee public domain.

I created every single item in that database through my own actions. Any score, categorization, or classification created from that data is a derivative work. Who the hell are they to act like they have more of a right to it than I do?

Re:Choicepoint/DBT have had many PR problems befor

[NewStarRising]

PR Problems?
Thousands of people are denied their democratic rights, thousands more have their personal details illicitly accessed, and you call it "PR Problems" ?

"Oh, but it WILL affect their PR!"
Yes, but that is not where the problem lies. The problem lies in the company not being capable of doing its job.

Just to remove some ambiguity from the posting...

[Angostura]

Although the posting notes that the company has notified several thousand Californians, don't take this as suggesting that the damage is limited to Californians. From the article:

"California law requires firms to disclose such incidents to the state's consumers when they are discovered. It is the only state with such a requirement but such data thefts are rarely limited to a single geographic area."

Time to start lobbying some other states' legislatures, perhaps.

Ultimate consumer-friendly solution

[Karl Cocknozzle]

...Is to make credit bureaus and data aggregators like Choicepoint liable for inappropriate data dissemination.

These companies are in a position of responsibility, but they don't seem to take it very seriously. The credit bureaus have already bribed their way into legislation that makes it your responsibility to correct errors in their data, not them. If we don't act now, they'll bribe (excuse me, I mean "make campaign donations") and get a free pass on handing out your data to the Russian mafia, too. I say make them liable for monetary damages, instead.

Institute it, and watch how fast their security improves. The attitude of: "Oh well, its not our problem" would be a thing of the past. OR somebody would sue them bankrupt. Either way, the consumer wins.

Plus, the idea of suing these bastards into bankruptcy appeals to me because of Choicepoint's role in George W. Bush's 2000 coup.

Yes its a crime

[Anonymous Coward]

"You're telling me that I should be charged with a crime?"

Its negligence to use tools that you know are unsafe.

IIS is unsafe. Anybody technical knows that. Gartner has told you that. There are a lot of good, cheap choices.... Apache, SunOne... That are secure.

So if you choose a tool which has a high incidence of failure, which experts recommend you not use on a public site, then yes. I would hold you liable for use IIS.

Nobody smart uses IIS these days. Its primarily the tool for mid-level cowboys who think anything from MS is the bee's knees.

Kneel, Kneel, Kneel

[Anonymous Coward]

In case you didn't know it, church is the best place to get laid. Pick a good looking chick, take her out dinner, have sex with her. You can read the bible together afterwards.

The only downside is that if "date" her saturday nights, you'll have to go to church with her Sunday morning. But you can chuckle as you shake the minister's hand. Little does he know where those fingers were a few hours before!

Me too - UK rules are scary

[Anonymous Brave Guy]

Not so long ago, I was surprisingly refused credit. In fairness, that part wasn't Experian's fault; it was down to an automated address database that didn't recognise the correct form of my address and decided I didn't exist. However, during the follow-up enquiries with the credit card company who'd turned me down, I obtained a copy of my credit record from Experian. There were so many minor inaccuracies it was scary. The best bit was when, at 17:05 after speaking to someone there for five minutes (after about a half-hour on hold), I was asked "whether it really matters, because I'm supposed to go home at 5". I was speechless, and for me that's saying something. ;-)

The really disturbing thing is that despite our actually pretty good data protection rules in the UK (the Data Protection Act does have some teeth, and thus far the Office of the Information Commissioner has proved to be very level-headed and apolitical in its actions) the entire credit and finance industry has basically managed to exempt itself. The credit agencies are allowed to keep files on me without my permission. Those files are obviously grossly inaccurate and poorly maintained, but if I lose out on something because of the bad information I have no recourse. (Well, I can add a "notice of correction" to the file after the fact, after getting a copy of my record at my own expense.) If a financial group turns you down for credit, they basically don't have to tell you anything, other than (a) whether an automated credit scoring system was used (in which case they do have to offer you a reassessment by a real human being) and (b) which credit reference agency/agencies they used.

Now, I'm not a big fan of credit in the first place. I always liked the advice to read "credit" as "debt": "3 years' interest free debt!", "I have a $50mil debt limit on my card!" etc. But in our society today, credit can be a useful tool when used judiciously, and if a market that is fundamental to the way our society currently works is to be allowed to regulate itself to the extent that it currently does, it has to be reasonable about fixing its mistakes. Otherwise, screw 'em, and let fly the lawsuits that everyone else would be subject to if they made the same sort of mistake with the same consequences.

The Shrub pushes for Tort Reform

[hydertech]

As an attorney, I would suggest that there is already adequate support in the law for an action against Choice Point. As some posters have already noted, the cost of litigation would prevent individuals from suing separately--the solution in such cases is to file an action on behalf of all those affected. This is called a "class action".

Of course GWB is pushing for "Tort Reform" to eliminate class action lawsuits in the United States.

It doesn't require a tin foil hat to see why this is such a priority for him when a major ally to his campaign is clearly in the sites for such a lawsuit.

Re:The Shrub pushes for Tort Reform

[anopres]

Of course GWB is pushing for "Tort Reform" to eliminate class action lawsuits in the United States.

It doesn't require a tin foil hat to see why this is such a priority for him when a major ally to his campaign is clearly in the sites for such a lawsuit.

Bullshit. We've been hearing about tort reform being a major platform issue since the mid eighties. But, since the congress is perenially made up of ex trial lawyers, nothing ever gets done. Maybe this president has enough clout/influence with the Republican congress, that something might actually get done.

Re:The Shrub pushes for Tort Reform

[Anonymous Coward]

He never tried to eliminate class action lawsuits you dildo. The bill you're referring to simply states that class action lawsuits that involve mostly plantiffs from a different state than the one where the suit is being filed must be transferred into federal court. Simple common sense. So plantiff attorneys can't "court shop" for the most favorable jury pool in the nation, like Madison County in Illinois. For an attorney, you sure have weak knowledge of the laws and current events. Then again, you probably just wanted to use this as a chance to get in some partisan Bush bashing to get a slashdot mod point, which I just took away from you in meta mod.

Compare with Belgium

[Anonymous Coward]

I live in Belgium. You know, the little country all of slashdot flamed or pitied because we got an electronic ID card.

The interesting point is: We don't have this problem: All the points mentioned about the electronic ID, or about the fact we have to have an ID, are THEORETICAL. In practice, this doesn't happen. As I read again and again on slashdot, in the country of the theoretically free people, lots of really ugly stuff happens again and again.

Maybe you should all come and live here, as we have some interesting laws and habits that protect humans:
* Every company, shop, ... that has personal information about me, must let me see it and modify it on simple request. If they want to give information to other companys, they have to mention that, and a simple request by me forbids them to do it (most shop's request-for-information-forms have a checkbox you can mark, and it is OK if you just write "i do't want this" on the other forms).
*Almost nobody is allowed to even ask for my ID card. The police can (they do when they check if you drive drunk, but i saw on TV how USA police asked for a SSN or drivers licence, so it is not really different there). Some high-ranked people on the trains are allowed to check it to see if you are e.g. not to old to get a ticket for young people. They are not allowed to write anuthing down about it. These are the only people that ever requested my ID,and in both circumstances, it is quite rare.
* It is not possible to steal money from my bank card by knowing it's number, as it is protected by a secret code. This is not perfect, but it works quite well and misuses are never so big as to have 30.000 victims)

So i would ask all the USA-inhabitants to stop whining about ID cards until you know what you are talking about. Your governement brainwashes you to believe you are free by pointing to facts like 'you have no ID - please forget about the SSN', but stories like this prove you wrong. Belgium is by no means perfect, but I'd much rather have my ID card than come over to the USA and suffer under your 'freedom'.

Not "Stolen"

[goldspider]

This is not theft. Nothing was physically taken from ChoicePoint. Copied, perhaps, but I have a different take on all of this.

If anything, this information was liberated by people who understand that it can't and shouldn't be bottled up and controlled by multinational conglomerates. These freedom fighters should be lauded as heroes, not vilified as "thieves".

Need I remind Slashdot about the natural tendencies and desires of information?

Re:Choicepoint/DBT have had many PR problems befor

[kryptkpr]

The problem lies in the company not being capable of doing its job.

Are you that naive?

They did their job perfectly well. Lots of people couldn't vote, Bush won. Job well done!

The question here isn't how well they've done the job, but what exactly the job to be done was.

Class Action Lawsuit Opportunity!

[Anonymous Coward]

All Lawyers Out There-- This is an example of complete negligence and will cause great harm, financial and emotional to potentially millions. Class action suits have been won on much less. Why doesnt someone fine a class action against this company? Unlike suing doctors, we'd be accomplishing much here -- we'd be going after a company which does not respect the rights of the American people.

government is biggest ChoicePoint customer

[peter303]

Most governement data mining ventures have failed such as two high-profile FBI projects and three iterations of an airline passenger database. Most agencies are inept in managing large software projects. So as a backup, the governement, mainly Homeland Security, has been purchasing private firm data.
To be frank, I don't see the government databases any more secure than private ones. Lowly clerks, some of those hired by affirmative action, are vulnerble to bribes as in the Colorado drivers license scandal.

Re:government is biggest ChoicePoint customer

[wolfie_cr]

I would love to know if they got my info! About 6 months from now the newspapers down here (In Costa Rica, Central America) were reporting that this very company was buying information from citizens all over, names/addresses/telephone numbers/property info/amount of purchases done using credit cards............etc Our laws are not even in diapers regarding protecting private info, it was mainly a non issue for us until the world started to become as interconected as it is now.......end result, now my info can end up in a foreign country before I even realize it!

Re:Experian (in UK) also screws you : my experienc

[Bob Uhl]

The thing is, without credit checking companies lenders would need to charge much higher rates. It was not that long ago (only a few centuries) that rates were 20-40%; there was a time when mortgages lasted until death (hence the name). By giving lenders more information, rates can be lower; with competition, rates are lower.

$100 is pennies in the grand scheme of things, and nothing compared to an extra percentage point of interest.

OT: Point System

[blighter]

Where is your point system used? I've never heard of that system.

The most common use of "point" in that respect that I've ever heard is in the US is to use "point" interchangeably with "percentage point", i.e. 1 point = 1% = 1/100.

The US Financail community will occasionally use "point" as short hand for "basis point" which is 1/100 of a percentage point or .01%.

But I've never heard of a semantic system that uses "point" to mean 10% and I'd be curious as to its origin.

Re:OT: Point System

[DrSkwid]

hehe I made it up

Re:OT: Point System

[shanen]

I don't know either, but I did some research, and that's how the saying goes. "Possession is nine points of the law", and most of the sources mean that it's basically legalese for "finders keepers".

Only consumers in California? Not!

[bwcbwc]

I doubt it. I think the only reason the California people were even notified was because of state law. Consumers in other states aren't being notified because those states don't have laws requiring notification.

Re:Experian (in UK) also screws you : my experienc

[cayenne8]

"A few years ago I applied for a mortgage, and got refused because the bank did a credit check with Experian, Experian told them I wasn't on the electoral register, so the bank turned me down."

What is an electoral register....and why would you need to be on one to get a mortgage loan?

What they say on the phone

[Anonymous Coward]

is that they are voluntarily notifying all affected consumers by mail in the next 3-5 days. This is according to Elliot who refused his last name, but said his identifier was CL6. His supervisor is Laurie Ann. Reach them at 800-342-5339, lots of 1's and a 2 I think to surf to the Consumer Division.

Boy do I feel better now. The bad guys ony have 3-5 days to rip me off blind. phew.

Re:Experian (in UK) also screws you : my experienc

[timmyf2371]

The electoral register is a list of all persons legally allowed to vote within UK elections, and it's one of the ways lenders decide whether you're a worthy risk or not.

Re:Experian (in UK) also screws you : my experienc

[cayenne8]

"The electoral register is a list of all persons legally allowed to vote within UK elections, and it's one of the ways lenders decide whether you're a worthy risk or not."

So...you have to vote over there in order to be able to get home loans? That doesn't seem fair...do they force you to vote over there? What does voting or not voting have to do with whether you can pay off a loan or not?

Uncle Sam

[macdaddy]

They are in fact already doing this with another subset of our personal information: our medical history. HIPAA prevents anyone from accessing your medical data that you haven't authorized. I'm starting a new job tomorrow and had a pre-employment drug screening today. I asked the nurse if she needed to note any prescriptions I've had recently. The nurse said they couldn't even ask that; that only the lab people could ask that if something came up. If Congress can get a law passed that protects our medical history, why can't they pass one that protects our financial history?

Ask them if you've been compromised!

[lilmouse]

They've got a webpage! They've got a "Contact us" page! Drop them a line asking if your data has been compromised. Be polite, explain you're not in California, but you still want to know. If they're not going to send out letters to all of us, I say give 'em hell!

http://www.choicepoint.com/choicepoint/home.nsf/co ntactemail?openform

--LWM

Re:Experian (in UK) also screws you : my experienc

[timmyf2371]

To make things clearer, the electoral register is a list of citizens eligible to vote. Voting is not compulsory and is just as private and non-enforced as any good democracy.

It's also a public record and frequently used for credit checking purposes since it's a good and accurate way of cross-checking prospective loanees but, as I said, it's merely one part out of many lenders consider when taking on a risk.

Re:Choicepoint/DBT have had many PR problems befor

[Anonymous Coward]

While you are remembering, don't forget the networks called the election in Florida before the polls closed, costing Bush thousands of votes in Western Florida a chance to win by thousands, not hundreds.

OOPS Sorry...

[jelle]

I should have seen the 'should' in that sentence...

I think we agree. Undo that last posting...

electoral register

[fantomas]

Credit companies use it as a shorthand method of identifying if you're a moral and upstanding citizen and hence likely to pay back their money.. I believed it's tied into identifying you for local taxes (feedback welcomed), so I guess the theory is if you're trying to dodge /too lazy to register for local taxes you're probably generally dodgy. I shouldn't be suprised if there are other aspects to it, e.g. considering if you move around a lot (older generations probably consider this suspicious behaviour), and the places where you live giving some socioeconomic measures of your income...

But yup, for my part I have had no bad credit, no criminal record, have no credit agreements, and earnt a decent low end professional income for several years prior to applying for the mortgage, so can only assume the electoral register issue was the factor that stopped me getting a mortgage. This also means I now have an official refusal from a bank on my credit record (due to the incorrect data held on me) that will prejudice further attempts to get a loan to buy a house/ car etc. Be afraid people, and even if you're a young anarchist now, quietly fill in your electoral register forms when the other punx aren't looking! Mebbes five years from now you n your pierced up truck driving fire breathing girlfriend might want to buy a little cottage somewhere and need a bank to help you get started...

Hackney!

[fantomas]

you'll love this - it was London Borough of Hackney. They've messed up a lot of stuff in their time but credit where credit's due (excuse the pun...), their staff were very polite and helpful.

ChoicePoint's Logging

[jerseygirl]

As a former ChoicePoint employee (I worked there for over 4 years) I am absolutely appalled. It was drilled into our heads that our mission was to "make society safer by the responsible use of the data." Hah! It is also NOT true that they don't know if your data was accessed. Most products log the searches that were performed for most user types. I know for the products I worked on, I could query the logs to see if my SSN, address, etc. were searched on.

Why isn't incorrect credit data libel?

[bitingduck]

ChoicePoint says "Our data, our mistake, your tough luck." Even worse in the case when they helped disqualify legitimate voters because they were paid to do so...

It's always seemed to me that bad data in credit reports could/should constitute libel. They're making untrue claims about you in print that damage your reputation.

I'm sure the defense they use is that "We're making a credible effort to ensure that the data are accurate, and therefore any untrue statements are unintentional". That argument seems a bit specious, given the reported prevalence of errors in credit reports-- if there were errors in 1-2% or less, it might be plausible, but when nearly a third of reports have significant errors in them (according to consumer reports) that's starting to look like negligence. Similarly with ID theft--a friend had her identity borrowed, and the utility that her name was used with was given a made up drivers license number over the phone. They certainly failed to do even the minimum to verify identity, so why shouldn't they be sued for libel when they say something bad about her?

It seems like libel is a straigtforward way to force the credit agencies to bear liability for maintaining their records (and other companies for reporting accurate data to them). And this may be a case where millions of individual suits is more effective than class action-- death by millions of tiny cuts.

Re:Why isn't incorrect credit data libel?

[shanen]

I'm fairly sure that libel requires intent, and there's none there. ChoicePoint just says we received the report in good faith and passed it on--which is all they claim to do. (In reality, they often do much more analysis than that, but that's getting into different privacy issues.)

Re:Why isn't incorrect credit data libel?

[bitingduck]

I took a look at that standard for legal information, the Wikipedia (I'm not a lawyer and don't play one on TV), and in the brief description of US libel law they give a couple of standards-- for public figures there has to be "actual malice" or "reckless negligence" for whether the statement is true, but for a private person, simple "negligence" is enough. If ~30% of credit reports have substantive errors in them, I'd suspect them of being pretty reckless.

(FWIW, last time I checked mine there were no 'errors', but there were substantive differences in how the different agencies classified the same accounts)

Private Numbers and Protecting your Identity

[the.aham]

"A friend never allows her SS # to be used for anything. Not banks, not schools, not health insurance. They squawk and scream and threaten and she stands firm. ... Massachusetts also allows one to use a generated code instead of SS # on drivers licenses."

I admire your friend, and I'm the same way.

From what I understand, Arizona is also the same way - you can have a randomly generated number for a DL#. Also, you can request a "private SSN" (it might be called something else) for your academic records - it's a 9-digit number that starts of with three 9's. Eg: 999111111. I'll be doing that when I have kids.

On a related note...

Some other thing you can do to protect your identity is to simply cross out the first 12 numbers of your credit card number on any receipts. All the merchant needs for their records is the last 4 numbers of your CC to confirm transaction at the end of the day. I'm so amazed that so many restaurants grocery stores and merchants print the whole 16-digit number on the receipt.

And, the doctor's office. All they really need is your name and where to mail the billing statement to (Read: mailing address, unattached to your home if you'd like). They DO NOT need your Driver's License Number or the name of your pet dog. I don't think they even need your Social... unless you're on Medicare or another government-authored plan.

Copy of the Letter?

[abruski]

Has anyone actually received one of these warning letters from ChoicePoint? I would be interested in seeing exactly what it says.

You forgot the OCC

[ruheling]

The US Office of the Comptroller of Currency (OCC) requires banks, S&Ls and others to have a "customer identification program" to be compliant with the Bank Secrecy Act and the Patriot Act. In short, banks have to have reasonable assurance that you are who you say you are before they're allowed to open an account for you - that precludes what you're talking about.

If you're really nerdy, more information is available at (http://www.occ.treas.gov/BSA/BSAGuidance.htm)

It'll kill the wart, but keep the virus

[anachronista]

'Course, marketing databases keep much of the same information as credit reporting databases--except whether you made your payments or not--and there's no suppression list for them.

Companies like Harte-Hanks and Conversant compile consumer databases from multiple sources, then match them to build more robust records.

So, every time you buy napkin rings at Crate&Barrel they'll ask for your ZIP. They'll send in along with your purchase history and the name from your credit card to some transactional database. That db will get matched to a master db--and, viola, C&B knows who you are, where you are, what you're spending, how you're paying, and what you're buying.

Then, C&B might sell that db to HH for a whack of cash, and HH will link it to a USPS and census files. The latter contribute your most recent mailing address and demographic data. Plus, they'll match it against other purchased files, so a single file will tell them who you are, where you travel, where you shop, what you buy, how much you spend, where you live, how old you are, what degrees you have, your gender and ethnicity, and a bunch of other things like whether you're divorced and what your kids' names are. They also used to link the files to credit card information, but that's nominally illegal now.

Why do they do this? So that they can sell the fat bundle to Pier 1 for two whacks of cash.

If you ever get an unsolicited catalog in the mail that actually looks kinda cool, just remember that it means somebody's got a damned big data file on you.

And you can call companies like Pier 1 and tell them to take you off the list (despite the fact that they can mine their customer dbs daily, they'll take six weeks to delist you--but they will delist you), but that won't take it off of the lists of pimps like Harte-Hanks, who are still selling you to other companies. Regulation is the only hope for data protection. ChoicePoint is the Enron of the data pimping industry, and we can only hope that it leads to a sort of Sarbanes-Oxley Act for data pimping companies. Make it happne: write your senator.

Choicepoint Response

[James Lee]

We at ChoicePoint understand the concerns and fears that many of the posters to this site have expressed in recent days and wanted to briefly clear up some questions. First, ChoicePoint voluntarily notified 145,000 people whose files MAY have been accessed in this incident. We did so as soon as the California legal authorities informed us of the extent of the problem. We've told those potentially affected how ChoicePoint will help them monitor and correct any situations regarding the potential identity theft issues. We've also changed our internal procedures as part of our ongoing effort to make our databases more secure, and continue to look for ways to further strengthen the vetting process for new customers as well as how we seek potential fraud or abuse once customers begin to use our data. We understand that there is great suspicion and a lack of understanding about what we do and how we do it. We hope to begin and encourage a broader dialogue on the risks and rewards of information uses. Hopefully, some of your questions can be answered by checking the homepage of our ChoicePoint website at www.choicepoint.com. James E. Lee, Chief Marketing Officer of ChoicePoint