Slashdot Mirror
Ameritrade Customer Data Lost
Rollie Hawk writes "Continuing the recent trend of customer data blunders in the news, Ameritrade has announced the loss of the personal data of up to 200,000 customers. The suspected cause is a routing error, but not the network kind. The online discount broker admitted that a backup tape of customer account data from 2000 to 2003 has been misplaced. They claim the cause is an error on the part of a shipping company. The tape was identified as missing in February, soon after being shipped. According to spokeswoman Donna Kush, nothing suspicious has been reported. Further blaming the shipping company, she explained that "this was not an Ameritrade Systems issue or a compromise of our technology. This was related to a third party vendor." It's doubtful that current and former customers with exploited information will care how this occurred. She further claimed that Ameritrade "has every reason to believe" that the tape has either been destroyed or is being held by the shipper. There's no word yet on how they arrived at this conclusion."
I mean, it's probably more likely that some law got passed in the past few years that's forcing companies to highlight all these incidents of compromised data, but it seems pretty spooky that we just recently hear about all these stories...
Make sure everyone's vote counts: Verified Voting
If date is being transported via a 3rd party carrier, wouldn't it make sense to encrypt the data first?
Luckily it was insured against loss and Ameritrade will be recieving a check for $100 dollars!
oh HooRay!
Starsucks
It's doubtful that current and former customers with exploited information will care how this occurred.
While I would be upset if this was my personal information, if Ameritrade did what they were supposed to do (as in ensuring the shipping company was a decent company) then I would not be so uptight about the situation. People like to scream, shout and vent. Shit happens. If someone was grossly at fault they should be flayed, if it was a pure accident (as such things happen) well it is what it is.
I mod down so you can mod up. Your welcome.
A feeling of having made the same mistake before: Deja Foobar
This is happening all the time now. Here's another:
http://news.bbc.co.uk/1/hi/business/4444477.stm
Once again, let me suggest that it may be time to legislate significant penalties for companies and/or individuals who are careless with personal data.
Every year during my review, I just pray the words "slashdot.org" aren't mentioned.
Thankfully, all my tech stocks have tanked and there are no more assets to attack. As a matter of fact, I'm more likely to get sued by identity theives for ruining their reputations and credit ratings.
My favorite:
i tr ade/
"the missing back-up tape contained compressed data that would require very advanced computer systems to access."
http://money.cnn.com/2005/04/19/technology/amer
Note she did not say encrypted. Modern tape software is often intelligent enough to recognize not only its own compression algorithms, but also formats and algorithms used by other vendors. Maybe Ameritrade thinks they are one of the only companies in the world utilizing LTO, or maybe LTO-2?
We could then refuse to do business with those companies on the grounds that they were obviously lying.
-- Nothing unusual happened today
"...Further blaming the shipping company, she explained that "this was not an Ameritrade Systems issue or a compromise of our technology. This was related to a third party vendor."
Ah, no.
This is squarely the problem of Ameritrade management. Protection and recovery of backup data rests squarely with IT. There should have been a detailed process done in conjunction with a reliable shipper to ensure protection ( or perhaps a private courier ) of the tape.
Yet another clueless corporation that has no sense of responsibility.
Got a letter last week from American Century that 2 PCs had been physically stolen form the American Century office containing account information -- names addresses, balances, but no SSNs.
I am not a crackpot.
...about how the data was lost. It's a little bit difficult to get angry about a lost package in the shipping process. It happens. It's always going to happen. It's rare, though. I'd be a little pissed off if this was due to a network breach at Ameritrade. As it is, I'm not too concerned. So, yeah, it DOES matter how the data was lost.
Further blaming the shipping company, she explained that "this was not an Ameritrade Systems issue or a compromise of our technology. This was related to a third party vendor."
No, it's an Ameritrade-picking-a-bad-vendor issue. It is still ultimately Ameritrade's fault.
So I've been creating a list of all the major cases I've heard about in 2005. Nearly 1.3 million people have been affected so far this year. Of course now Slashdot won't let me post the information because I have "too few characters per line."
r ade/
/ a/2005/04/14/financial/f064639D31.DTL
/ archive/2005/04/08/financial/f115753D39.DTL
0 05/03/29/BAG3MBVSFH1.DTL
h ed&ctrack=1&cset=true
I originally posted an expanded version of this list on my blog to start keeping track of everything.
Here is basically what it looks like:
Date: 04-18-2005
Name of Organization: Ameritrade
How: Lost backup tape with shipping agency
People Affected: 200,000
Link: http://money.cnn.com/2005/04/19/technology/amerit
Date: 04-14-2005
Name of Organization: Polo Raplh Lauren - Mastercards
How: "Security Breach" - Hackers
People Affected: 180,000
Link: http://www.sfgate.com/cgi-bin/article.cgi?file=/n
Date: 04-08-2005
Name of Organization: San Jose Medical Group
How: Stolen Laptop
People Affected: 185,000
Link: http://www.sfgate.com/cgi-bin/article.cgi?f=/news
Date: 03-29-2005
Name of Organization: UC Berkeley
How: Stolen Laptop
People Affected: 98,000
Link: http://sfgate.com/cgi-bin/article.cgi?file=/c/a/2
Date: 03-26-2005
Name of Organization: Northwestern University
How: "Security Breach" - Hackers
People Affected: 21,000
Link: http://www.chicagotribune.com/technology/
chi-050 3260274mar26,1,5138021.story?coll=chi-technology-
Anyway, this is definitely getting ridiculous and out of hand. And it seems we're pretty much helpless to control it as well. When are a lot of these companies going to stop requiring valuable information like social security numbers and such?
There is no excuse not to encrypt all backup tapes anymore where sensitive data is involved. There are appliance-style products out there specifically for encrypting tape backups, if you can't figure out another way.
And I'm sure there are plenty of SW solutions also.
This kind of crap has been happening too often.
I hate to say we need a law, but we need a law.
doesn't mean they haven't lost it, but failed to report it in such a way that the media passed it on.
We're dealing with a very small subset of firms that have either been forced to admit, or have voluntarily admitted, data loss of customer records and personal data collected either with or without permission.
The number of firms that haven't admitted it, but have had it happen, is a LOT bigger.
-- Tigger warning: This post may contain tiggers! --
I work for a company that designs and builds devices used in the medical industry. If we use a third party for hardware or software, we have to verify and vouch for that software. If a patient gets hurt because some 3rd party app did something wrong, the 3rd party doesn't get sued, we do. It should be the same for personal data. Ameritrade should have made sure the data was secure, whether it was in their hands or not. If anyone's identity gets stolen, or they get ripped off in any other way, Ameritrade should be liable for the loss plus damages! As should all of the other companies that are losing personal data.
the only solution is the eradication, entirely, of the notion of 'personal data'. by that, i mean: you personally should be recording everything, not just the company. both sides should have their full records, for there to be 'fairness'.
until there is such a common, accepted, standardized practice, there will always be a mis-balance of corporate-Entity(knowledge of individuals) versus indepent-Entity(knowledge of corporate state). the reason we hate big brother is because we have no control over him; we'd accept his conditions, if turnabout was enforced by the state, and we had just as much public oversight of government as 'it' does 'us'.
from now on, simply record every single thing you do, anything thats a part of an agreement made with some company, yourself. save every single thing 'they' print you, put it in your system so that you data-mine them. use your digital prowess to record as much of your 'person->corporation' interaction as possible.
do it for a year, and then see how you feel about corporate loss of data.
its an odd thing, but in fact total-awareness is the only solution to problems of individual privacy versus corporate responsibility. its a wry old universe, doing the irony thing again..
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
Just gave them a call to close my account and I must say that they (or at least the person I talked to) was well versed on the talking points from the press release.
1) Blame third party
2) Data is not lost, we just don't know where it is
3) There has been no evidence of the data being used
The woman I spoke with was pretty adamant about making these points and really tried to keep me from closing my account.
I am not sure if this sort of revelation usually results in a significant loss of business or not, but it would appear they were well prepared to rebut peoples concerns.
"Oh, you hate your job? There's a support group for that, it's called everyone, they meet at the bar."
One tape backup tape. Appears to be functional, bought from local shipping company at auction. :-P
I work with eCommerce for a living. Credit card processing requires the CC#, Exp date, CVV2 code (the digits on the back of the card) and the billing Zipcode.
Why then must we supply name, address, phone number, email, and other personal information just to make a purchase? (obvious answer is for customer profiling and contacting post-sale.)
I try to refuse to provide a SSN whenever I recocgize it isn't needed (like to establish an account at the local dry cleaners) but so often, employees become adjitated, as if I am trying to hide something.
We as consumers need to do more to protect our own personal data from getting to 3rd parties in the first place.
Now obviously Ameritrade needs such financial and personally identifying information for SEC and IRS compliance, but in that case, they should be required by an oversight body to protect that information.
HIPPA protects the privacy rights of US citizens healthcare information and has two very important rules:
(1) information must be secured
(2) only the minimal information may be collected when required and only the minimal information may be shared with those who require it.
Why doesn't this exist for SSN, bank account numbers, etc?
I only came here to do two things; kick some ass, and drink some beer...looks like we're almost out of beer.
"this was not an Ameritrade Systems issue or a compromise of our technology. This was related to a third party vendor."
I'm so peeved when I see comments like this. When will people realize that when they hire a 3rd party vendor to complete a task they are not absolved of responsibility. This IS an Ameritrade Systems issue. They didn't encrypt their data. They didn't hire a responsible shipper. They still "own" the issue.
I did technical account management for years. One thing our group was primarily responsible for was saying "Yes, this is our issue, we will see it to resolution". Even when the blunder was caused by a 3rd party, we owned it. It was our responsibility.
Encryption is not expensive financially. Decent encryption tends to be computationally expensive, though, and may slow backups. Worse, it involves changing processes. Ever tried to make a bank change how they do things?
What I say does not represent the views of my employers, my friends, my cats, or myself.
1) Blame third party
"I don't do business with companies that cannot and will not take responsibility for what happens to its personal data (or whatever else). In the end, you are where the buck stops. Not the shipping company that you contracted."
2) Data is not lost, we just don't know where it is
"If you don't know where it is, then it is..." *drumroll*
3) There has been no evidence of the data being used
"Not that you know of...or yet."
People say I'm crazy, I got diamonds on the soles of my shoes...
(i) The member, broker, or dealer must notify its examining authority designated pursuant to section 17(d) of the Act (15 U.S.C. 78q(d)) prior to employing electronic storage media. If employing any electronic storage media other than optical disk technology (including CD-ROM), the member, broker, or dealer must notify its designated examining authority at least 90 days prior to employing such storage media. In either case, the member, broker, or dealer must provide its own representation or one from the storage medium vendor or other third party with appropriate expertise that the selected storage media meets the conditions set forth in this paragraph (f)(2).
(ii) The electronic storage media must:
(A) Preserve the records exclusively in a non-rewriteable, non-erasable format;
(B) Verify automatically the quality and accuracy of the storage media recording process;
(C) Serialize the original and, if applicable, duplicate units of storage media, and time-date for the required period of retention the information placed on such electronic storage media; and
(D) Have the capacity to readily download indexes and records preserved on the electronic storage media to any medium acceptable under this paragraph (f) as required by the Commission or the self-regulatory organizations of which the member, broker, or dealer is a member.
Brokers are required to use a storage medium where tampering is evident. Once that was bound ledger books written in ink. Later, it was bound books of computer printouts. Then it was microfiche. Today, it's CD-ROM or DVD-ROM. But not magnetic tape. Not even for backup.
And if a securities firm outsources some of its back office operations, the outsourcing firm has to make certain filings with the SEC:
-
(i) If the records required to be maintained and preserved pursuant to the provisions of Sec.Sec. 240.17a-3 and 240.17a-4 are prepared or maintained by an outside service bureau, depository, bank which does not operate pursuant to Sec. 240.17a-3(b)(2), or other recordkeeping service on behalf of the member, broker or dealer required to maintain and preserve such records, such outside entity shall file with the Commission a written undertaking in form acceptable to the Commission, signed by a duly authorized person, to the effect that such records are the property of the member, broker or dealer required to maintain and preserve such records and will be surrendered promptly on request of the member, broker or dealer and including the following provision
...
Ameritrade needs to address these issues. As a broker, they are not allowed to be casual about record-keeping.I lost our backup tapes once. I left them on top of my car when carrying them to the off site storage. Fortunately, or mabye unfortunately, when I went looking for them, I found that I had ran over them. User data safe, 6 dds4 tapes destroyed, huge ulcer from worrying about server crash on the day of incident.
"It's not the despair, I can take the despair, it's the hope that's killing me!"
1. There are algorithms that are designed for realtime encryption, i.e. twofish. 2. There is special hardware that can perform encryption/decryption much more efficiently than your general-purpose CPU. Just because microsoft backup doesn't support encryption doesn't mean that any serious backup software won't do it. If your backup software/system doesn't support encryption, it was designed for home-users (despite what it claims). When the market demands encryption, software vendors will step up. Or maybe I should say "if".
Good point. ;)
What you are quoting are the rules for archival storage of information (that is the rule that requires orginasations to store for 6 years data relating to their transactions for compliance purposes.) This does not apply to all information retained by brokers (but to specific transactional related data), and it most certainly does not apply to regular backup procedures
never underestimate the amount of data that can be lost in the back of a truck.
The Kruger Dunning explains most post on
You have it backwards. Cheap Bulk mail subsidizes first class mail. It's bulk, remember. It may be cheaper, but they send out thousands of them. Bulk rate minimum is 12 cents. It is usually more like 18 cents and can go up to almost 30 cents.
In your situation, the mailman must come to your box, which takes time. In most cases, he must merely stop at the street. In many communities, regulations will not allow a house mounted mailbox on new construction. It must be on the street. The Postal service does not charge based on the "worst case" of having to go to the box, but on the average case which is a mix of the two. Apartments are even better because they can get hundreds of peoples mail sorted out in maybe five minutes thanks to centralized mail facilities.
The Post office must take into consideration good situations like an apartment building, with bad situations, such as rural routes with one house every mile. Unlike many other delivery companies, they offer the same rate for any mail delivery anywhere in the United States. Great if you like to send mail from New York to California, not so great if you are inviting people to a block party.
The USPS makes money. The billions of peices of bulk mail they send every year helps us to enjoy reasonable first class stamp prices.
If you are not allowed to question your government then the government has answered your question.
I would rather think it is another example of corporations failing to effectively police themselves and the government having to step in. Free Enterprise would work like a dream if companies took responsibility for their actions - then governments wouldn't have any place to step in.
bun-fhuinneog agam!
Auditors find IRS employees vulnerable to hackers (3/17/05)
... claim a user identity and then use that identity to gain access to sensitive taxpayer or Bank Secrecy Act data," the report said.
More than one-third of Internal Revenue Service employees and managers who were contacted by Treasury Department inspectors posing as computer technicians provided their computer login and changed their password, a government report said Wednesday... That was a 50% improvement when compared with a similar test in 2001, when 71 [of 100] employees cooperated and changed their passwords.
IRS Flaws Expose Taxpayers to Snooping, Study Finds (4/18/05)
In all, 7,500 IRS employees, law enforcers and outside contractors can access and modify tax returns and financial-crime reports, the GAO found. A master list of passwords and user names is also widely available, the report said. "Increased risk exists that unauthorized users could
--
My Aunt sells identity theft insurance. Email me and I can put you in touch with her.
Dear valued Ameritrade customer:
Due to computers errors, we may have lost some of your informations. Please go to the following web site and verify your informations. Please do so as soon as possible or your account may be suspended. Thank you.
http:/256.123.321.201/Ameritrade.html
If a job's not worth doing, it's not worth doing right.