Slashdot Mirror


ChoicePoint Identity Theft Fallout Widens

dstates writes "A unique California law forced ChoicePoint to reveal that a break-in had compromised accounts revealing personal information on 40,000 southern californians and leading to more than 750 cases of identity theft. The company initially denied that the break-in compromised consumers outside of California, but CNN is now reporting that 110,000 accounts nationally have been compromised. 'The irony appears to be that ChoicePoint has not done its own due diligence in verifying the identities of those 'businesses' that apply to be customers,' said Beth Givens, director of the Privacy Rights Clearinghouse. 'They're not doing the very thing they claim their service enables their customers to achieve.'"

27 of 297 comments (clear)

  1. SHUT THEM DOWN by centipetalforce · · Score: 5, Insightful

    Serirously- this isn't paperclips these people are selling ITS YOUR PERSONAL DATA. They need to be closed, and whoever responsible needs to go to jail- and everyone involved in covering up the crime deserves to live in poverty for the rest of their fucking lives.

    1. Re:SHUT THEM DOWN by Jeremiah+Cornelius · · Score: 4, Insightful

      IANAL, but I am a Security Consultant. Considering the financial and healthcare data, there are probably SERIOUS violations of GLBA and HIPAA. Let's look for some SOX violations, and get jail-time for the CEO!

      --
      "Flyin' in just a sweet place,
      Never been known to fail..."
    2. Re:SHUT THEM DOWN by MillionthMonkey · · Score: 2, Insightful

      What are you telling us for? Why aren't you writing your senators instead?

      Seriously- all of you who have been making this same complaint on Slashdot- have you also been complaining to your elected representatives? (I haven't, but I have an excuse- I live in the "People's Republic of California". No letter from ChoicePoint in my mailbox yet!)

      This is really amazingly egregious that they shouldn't be required by law to contact you if they realize they sold your mother's maiden name to mobsters. I can't believe how shit happens in the rest of the country sometimes.

    3. Re:SHUT THEM DOWN by s74n13y · · Score: 2, Insightful

      So a unique California law, under their misnamed "deregulation" system, caused them to open their books, when they simply feel that 110,000 to 350,000 consumers are ignorant. They were entrusted with data security, was it worth it? Anyway, how many more consumers' personal data was thoroughly scrutinized by these thieves? This is what you got when you let ex-Governor Davis exercise his own self interest, the economy of California and rolling blackouts leading to a re-statement of Enron's books. When will they get honest and start acknowledging that they FAILED US? I get the distinct impression that a break-in compromised the data and they're not done. It's dog food alright, meaning these executives ought to be going to JAIL. They act like they weren't under any legal obligation, rather like outright deception. The irony appears to achieve its own success in some sort of narcissistic manner.

      On the ChoicePoint web site, the only reason we found other than stated above was a unique California system of overcharging, revealing personal information to anyone outside of California, maybe not far from the other 110,000 people who will receive notice of their fleecing soon. ChoicePoint said Tuesday it sent warning letters to track down serial killers stored behind a cloak of secrecy. This is what you get when Privacy Rights Clearinghouse sells to the highest bidder. These kinds of California laws hand their 35 million consumers over to ignorance. Beth Givens, director of one of those 'businesses seeking to gain access to people outside of California' had higher standards. I guess not. Perhaps they will send an additional notification to her lawyer informing that they have her system-gaming scam in an investigation.

      Make no mistake, state of California FAILED US. I get the distinct impression that ChoicePoint said it would jeopardize the tools they build. So does ChoicePoint use these tools they build? So does ChoicePoint use their customers' information for their own gain? ChoicePoint is a bunch of criminals posing as a legitimate business seeking to gain access to personal information so as to be a provider for identity theft criminals.

      Tell me one personal information provider who is not in some way guilty of identity stolen. All 50 states.

    4. Re:SHUT THEM DOWN by vinn01 · · Score: 2, Insightful

      .. and no company will ever have a security breach again.

      If you make the penalty for security breaches so severe, at the very first sign of a breach, a company will wipe all trace of it and pretend that nothing ever happened.

      A lot of companies already do this for the sake of "saving face" in the marketplace. No company wants it to be widely known that they don't know how to secure sensitive data.

      I bet that ChoicePoint was caught red-handed, otherwise we would not be hearing (and complaining) about this.

    5. Re:SHUT THEM DOWN by Stiletto · · Score: 2, Insightful


      Seriously- Nothing is going to happen to the CEO of ChoicePoint, or anyone else in charge. Worst that'll happen is a few execs are pushed out with multi-million dollar golden parachutes. They'll be retiring with their mansions and yachts, and we, the little people will be fired, homeless, or in jail because our credit report and background check says we're deadbeats and wanted criminals.

      I LOVE THIS COUNTRY!

    6. Re:SHUT THEM DOWN by demachina · · Score: 3, Insightful

      Nice sentiment but not very realistic. If you close down ChoicePoint you would pretty much have to go after Equifax, Experian(formerly TRW), and Trans Union. In case you don't know the name these are America's big three credit bureaus, where Choicpoint is more ID, criminal record, and financial records rolled in to one. It appears pretty much anyone can form a corporation and start collecting your personal data, thats what all four of these companies did.

      Why do they exist, because other corporations want and need the data they have on you and will pay for it, that includes potential employers and landlords, banks, car dealers, real estate brokers, etc. etc.

      You can't stop all this information tracking without eviscerating employment screening, loans, credit cards, etc. I'd be all for it personally but there are trillions of dollars of big business that rely on these companies and they would scream bloody murder if you tried to shut them all down.

      Choicepoint in particular probably experienced a boom after 9/11. The rampant paranoia that ensued multiplied by an order of magnitude the number of employment ID and criminal background checks employers conduct on prospective employees. Chances are if you are applying for a job with a company of any size their HR department is getting a COMPLETE run down on you form Choicepoint or someone like them, every criminal offense, how good you are at paying your bills, bankruptcies, loan history etc. Chances are they know every gory detail of your entire life, before you get an offer letter.

      In case you didn't know Choicepoint sucks up every court document in every state so they probably have a more detailed criminal history on everyone than state or federal governments.

      Its not entirely clear what the benefit is of having 3 different agencies scoring your credit plus Choicepoint, it just increases the likelihood of data compromise, and if there is an error in your credit report you pretty much have to correct it in all 3 places at your expense. But again any company can form to do this and all they have to do is collect data, market themselves and gain momentum where enough people use their service and you can have 4 or 10 agencies like this.

      There is some regulation of credit bureaus, though I'm not sure Choicepoint falls under it, they should.

      You could propose that only the Federal government should hold all this data but it doesn't really help because this whole system is predicated on allowing pretty much any business who wants it to request this information about you before they hire you or give you credit.

      You in fact have no privacy and haven't had for a while. Until the Federal government converts your Social Security number to a true encrypted digital signature with some minimal security, i.e. a password only you know to validate its yours, EVERYONE is a sitting duck for identity theft in the network era.

      --
      @de_machina
  2. Re:Ouch by pbranes · · Score: 4, Insightful

    Well, funny that you mention that. What computer cracker goes into a network and *only* steals the data for 1 state?? No one! Choicepoint was flat out lieing and being unfair to the consumer by stating that only California was affected. It was only when the heat was turned on them by the news media & the internet bloggers that they admitted that more people were affected & would be notified.

  3. They're a company..... by darkonc · · Score: 3, Insightful
    'They're not doing the very thing they claim their service enables their customers to achieve.'"

    If they did that, it would cost them business. That would cost them profit. They're a company. Next question?

    --
    Sometimes boldness is in fashion. Sometimes only the brave will be bold.
    1. Re:They're a company..... by Stephen+Samuel · · Score: 2, Insightful
      If they go almost-bankrupt as a result of the class-action suit, it might cause them to be more careful about who they allow to do searches. Truth of the matter is that the only reason we even know the scale of this is that California had a left-wing commie customer notification law on the books, otherwise they would have probably just sent out notices to thousand of the most seriously affected and hoped that nobody noticed a larger pattern.

      As it is, even a class-action suit might not cost them as much as they gain by allowing anybody and their dog to make a query. I've actually been quietly expecting this sort of event for years.

      --
      Free Software: Like love, it grows best when given away.
  4. +750 in California alone! by thinkliberty · · Score: 5, Insightful

    "leading to more than 750 cases of identity theft." I wonder how many total cases of identity theft this incident will cause.

    The only way to know is to notify all people that had their identity stolen. All 50 states need to have a ID theft law like California.

  5. Eat Your Own Dog Food by PatientZero · · Score: 2, Insightful
    We developers are fond of saying that we eat our own dog food, meaning that we use the tools be build. So does ChoicePoint use their own service, implying their service is suboptimal, or do they simply feel that our data security isn't worth it?

    Either way, how many more times do things like this need to occur before people will become widely convinced that companies such as these need to be more thoroughly scrutinized?

    --
    Freedom to fear. Freedom from thought. Freedom to kill.
    I guess the War on Terror really is about freedom!
  6. What you get by mboverload · · Score: 4, Insightful

    This is what you get when consumer information is obtained and stored behind a cloak of secrecy. This is what you get when privacy laws are not enforced or valued. This is what you get when the standard consumer is ignorant and apathetic to the importance of person information.

  7. denied? by fireduck · · Score: 5, Insightful

    "The company initially denied that the break-in compromised consumers outside of California"

    Did they actually deny that no one outside of California was compromised, or was it just that they weren't legally obligated to inform anyone outside of the state? From Monday's story, I got the distinct impression that it was the latter (i.e., no legal obligation), rather than outright deception. Regardless, it's still a really crappy thing to have happened.

    (on a personal note, given that the break-in happened months ago, and i just got my yearly free credit reports from the 3 agencies and didn't see anything suspicious, I guess I'm a lucky SoCalifornian...)

  8. Importance by mboverload · · Score: 2, Insightful

    Tell me one person who would be against putting these executives in JAIL. They were entrusted with data on almost every human being in the United States and they FAILED US. Get the stake, timbers, gasoline, and matches. Heaven knows I am ready for blood.

  9. Manifest Destiny by Doc+Ruby · · Score: 5, Insightful

    These kinds of California "sunshine" laws are also the only reason we found out about Enron before it took the whole US economy, not just Houston, down with it. Enron was required by California law, under their misnamed "deregulation" system, to open its books, because it was supplying a lot of energy to Californians. Enron refused, claiming that, as a Texas company, it was not under California jurisdiction. That was when Governor Davis famously asked the Federal Department of Energy to step in, to resolve this interstate conflict. The DOE refused to referee, and Davis eventually found other means to force open Enron's books. When they were reviewed, not only was $8B in California overcharges revealed, but the entire network of Enron debt-laundering was exposed. As well as the rest of their system-gaming that took them out.

    California is far from perfect. But their 35M consumers are unusually well protected by laws in the public interest. The economy of California scale forces car makers around the country, and around the world, to comply with their higher standards. Perhaps we will see California's own self interest protect us from other scams like these, as we all get closer to the Golden State.

    --

    --
    make install -not war

  10. Re:Trust us! by Mysticalfruit · · Score: 4, Insightful

    The irony being that if you called checkpoint or even showed up at their door with documents proving that you were who you said you were, they probably wouldn't show you the data they've got stored on you.

    Not to mention the fact if they have erroneous data in their databases, you probably never get it corrected.

    --
    Yes Francis, the world has gone crazy.
  11. Thanks to California by SilentJ_PDX · · Score: 4, Insightful

    I'm an Oregonian... so you know it takes a lot for me to say anything nice about California but...

    I just want to thank California for their identity fraud laws that force businesses to disclose when an unauthorized person has accessed records illegally. If it weren't for that, we probably wouldn't know anything about this.

  12. 35M consumers by serutan · · Score: 2, Insightful

    Maybe this is nitpicking, but could we please go back to saying "citizens" instead of "consumers?" Because consumers take whatever crap you give them. Citizens don't.

    1. Re:35M consumers by Doc+Ruby · · Score: 4, Insightful

      I wish we were all crap-rejecting citizens. But the fact is that these laws protect consumers, who corporations prize, not simply citizens, who corporations ignore. They're "consumer protection laws". The corporate execs like Ken Lay and his California office minions aren't as well protected by these laws, because they're citizens, not consumers. That's how we've got a fighting chance.

      --

      --
      make install -not war

  13. Class Action, Choicepoint victims? Think again. by Anonymous Coward · · Score: 2, Insightful

    Bush just signed a bill to curb class action lawsuits. link to full story below:

    http://abcnews.go.com/Politics/wireStory?id=512771

  14. Double Edged Sword by Mindmaniac · · Score: 2, Insightful

    Before condemning all of ChoicePoint look at all of the good things they have done like solving hundreds of rape cases, finding missing children, and doing the DNA tests of thousands of crimes. This incident is the result of one offices mistakes and I don't think it is representative of who they are as a whole. If someone wants information bad enough the'll get it. Look at how many times the CIA's website has been hacked into.

  15. Re:What benefit is it? by symbolic · · Score: 2, Insightful


    Must MILLIONS of US citizens have their personal information warehoused, prostituted, and subject to theft because of the comparatively few that it may have helped? This is one case where I believe the cost FAR outweighs the benefit.

  16. Re: and it's gonna continue to hurt.... by Anonymous Coward · · Score: 1, Insightful

    Businesses and governments across the world over the last 20 years said "oooo we need to modernise and to store everyone's personal details on computer"

    Whilst for efficency it is fine, actually in every other respect it was always going to be a bad idea.

    Things like this will continue to happen across the world unfortunately on bigger and bigger scales, of that I am convinced.

    It's just too easy. It doesn't matter what security you put in place. It doesn't matter what the punishments are.

    You can not equate storing millions of personal records accessible in one blob with any notion of security. All it takes is one break in, or one hacker, or one disgruntled employee working from the inside.

    And there is no defence, therefore the pwning continues....

  17. Re:How to find out what they know about you by Jherek+Carnelian · · Score: 3, Insightful


    > Please note that a consumer file does not necessarily exist for you with any one of the three companies.

    But it certainly will AFTER you have made a request to see their records, if any, on you.

    There is something inherently broken about having to give up your personal information to the very companies who abuse it in order to find out if they are abusing it.

    As a minimum, I think the FACT Act should be modified to prevent the companies from recording or otherwise using any of the information you provide when requesting your own records. As a better solution, I think there needs to be an independent third party whose sole purpose is to give consumers their own files from all the tracking agencies and which has very strongly enforced data-privacy policies.

  18. What does it take??? by Genda · · Score: 4, Insightful

    Attention all K-Mart Shoppers... that Bar-B-Q you are smelling is your collective butts in the fire.

    After undermining all sane separations between state, religion, and commerce, we find ourselve in what can only be described as a Nation of the Corporation, By the Corporation, and For the Corporation. You may now bow to your corporate masters.

    Our founding fathers saw government as a detestable necessity, so they wisely hamstrung it seven ways come Sunday, to keep it at bay. By giving corporations the same rights as "REAL FLESH AND BLOOD PEOPLE", without the same accontabilitiies or limitations, we created a monster. That monster was further allowed free access to influence and ultimately control our government. That brings us where we are today.

    A nation where your privacy is a farce, virtually nonexistent, while government and corporations alike enjoy almost complete opacity.

    Just last week a Federal Judge ruled in favor of the Governor of Maryland, in a suit involving reporters from the Sun Times being frozen out of press meetings. The Judge ruled that "the paper wrongly asserted a greater right to access to government officials than private citizens have. The right to publish news is expansive. However, the right does not carry with it the unrestrained right to gather information,"

    In short, A political leader, your elected representative, has the right to inform only those he likes or feels fit to inform. That and your primary organ of political enlightenment, the press, has no special right to garner information on your behalf. Add to that the recent $400,000 charge for FIA documents against the justice department, and the Gannon/Guckert debacle at the White House this week, and it's clear... the Government is hell bent on having it's citizens standing naked in the streets, stripped of every right to privacy and personal dignity, while they plot and practice "God only knows what" with complete impunity.

    The information disaster at ChoicePoint underlines the complete disregard that business and the Government have for the needs and the rights of every day citizens. Recent leaks suggest the final number of people exposed may exceed 400,000. If the government were working on your behalf, you would certainly see heads rolling immediately. However, I suspect you'll see none of that. The government is using these very companies to perform an endrun around the constitution, filling up government dosiers with information collected by these very companies, at the same time lucrative government contracts and multimillion dollar campaign funds are trading hands.

    We're at a critical time in history. Benito Mussolini defined fascism as "The Corporate State". Looking at the historical analysis of the last century, there's good reason why conservative and liberal law makers, educators in law and political science, and men of conscience around the world are calling the United States a fascist state. One of the certain casualties in such a government, are the rights and freedom of the individual. We still have a tremendous amount of infrastructure that protects us, and as bad as things are, no single person has yet amassed so much power that our government can be easily toppled. We're however in extreme danger. It'll take all our commitment, and every kind of contribution we as citizens can make, to bring our government back into it's proper place as an engine designed to promote the advancement of freedom, and justice. The alternative is too grim for words.

    Genda

  19. Re:Excellent Timing. by millennial · · Score: 2, Insightful

    Actually, most larger companies have insurance that covers most, if not all, of the cost of the settlements from class-action suits. The companies who were big enough to afford this didn't suffer.

    By the way, what the hell was Bush thinking, restricting medical malpractice suits? When hundreds (if not thousands) of people die from medical goofs (surgical error, medicinal overdose/allergy, etc) each year, why would he possibly think it's a good thing to prevent them from suing the people who hurt them?

    --
    I am scientifically inaccurate.