ChoicePoint -- What We Learned from Our Screw-up

xpangler points out an article in Baseline magazine in which "ChoicePoint's lead privacy & compliance executives talks about the 'more than 30' new practices and procedures the company has put in place since it mistakenly sold private data on 163,000 people to Nigerian criminals last year."

Comments

Lesson 1

[OakDragon]

Never trust anyone who says things like "Greetings!" and "Honorable", and who CAPITALIZES in very ODD places.

Re:Lesson 1

[Rosco P. Coltrane]

Never trust anyone who says things like "Greetings!" and "Honorable", and who CAPITALIZES in very ODD places.

Okay, I certainly won't trust you anymore then...

Re:Lesson 1

[soren42]

Never trust anyone who says things like "Greetings!" and "Honorable", and who CAPITALIZES in very ODD places.

Wait, wait, wait - we're not supposed to trust Japanese-Americans?

Re:Lesson 1

[soren42]

Well, there should be, damnnit. It's no wonder the majority of posts of Slashdot go unmoderated.

Mental translation

[finkployd]

Perhaps I am too cynical, but when I see this:
Carol DiBattiste, ChoicePoint's chief credentialing, compliance and privacy officer, says the company has taken numerous steps in the past year to make sure such a breach never happens again.

I cannot help but think they actually mean:
Carol DiBattiste, ChoicePoint's chief credentialing, compliance and privacy officer, says the company has taken numerous steps in the past year to make sure such a breach is never made public again.

Really, the ONLY consequence a company like this suffers from a breach is negative publicity and maybe a token fine. Even bad publicity is not really a problem for them since the people they hurt have no say in whether or not to do business with them.

When that is the case, I'll bet it much easier to clamp down on leaks and not reveal breaches to the public/government than prevent them.

Finkployd

Re:Mental translation

[aztec rain god]

Isn't the real lesson from that whole debacle that Choicepoint has no business handling my personal information? It seems to me like if they really were to 'get it', they would find a different line of work to be in, and perhaps do some form of good for humanity. In my mind, the real transgression going on wasn't the 160,000- odd cases of Nigerians getting their hands on the personal data, its the unknown number of 'legitimate' transactions.

I think you've hit a good point, that people have no say as to what is done with their info. There really needs to be a mechanism, or a form or something where I can tell Choicepoint to delete any records having to do with me.

Re:Mental translation

[Red Flayer]

As evidenced by (FTFA):

Another new measure: ChoicePoint this month created a security advisory committee comprised of DiBattiste, the company's CIO, head of internal audit, the chief business officer, chief marketing officer, chief administrative officer and general counsel. The group meets regularly "to ensure we're hitting every aspect of security and privacy," says DiBattiste.

Emphasis mine.

Maybe it's just me, but a roomful of CxOs, including the CMO (WTF? What's wrong with VP of Marketing?[1]), plus a lawyer can only equal one thing -- a PR push plus some moves to limit liability.

[1] Speaking of stupid CxO titles, what the hell is a "Chief Administrative Officer"? We call those "Office Managers" around here... or maybe even "Chief Operations Officer" if we're feeling perky. But who wants a title that screams "Long-tenure secretary"? Maybe it's just a problem with assigning titels to people who sit on the board of a company (e.g., are legal Officers) but fulfill more mundane roles in terms of operations.

Re:Mental translation

[finkployd]

What repercussions? Did they lose business? Sure they got hit with a 10 million dollar fine but look at their financial statements, that is barely a drop in the bucket for them.

Honestly, companies are losing hundreds of thousands of records containing personal data every week, THERE ARE NO REPERCUSSIONS! They say oops, a couple of blogs report it, and life goes on for them. Sure some people get royally screwed but those people cannot trace it back to the company that had the breach. Heck, the government is losing data on its employees and military people, do you really think they are in any position to punish anyone for it? They don't even try anymore.

Finkployd

Re:Mental translation

[Billosaur]

[1] Speaking of stupid CxO titles, what the hell is a "Chief Administrative Officer"?

a) Chief Administrative Officer - in charge of paper clip chains and bottom photos from the copiers

b) Chief Administrative Officer - new member of the Enterprise bridge crew:
Picard: ...and this Commander Throckmorton, our Chief Administrative Officer.

Re:Mental translation

[finkployd]

ChoicePoint isn't the only game in town, even in their specialized arena (they're a spinoff of Equifax). If they get a bad reputation for poor security then companies will stop doing business with them and start doing business with a competitor.

But why? How does their inability to protect data really hurt their customers one bit? What would the motivation be in dropping them because they didn't secure data very well?

And, contrary to many people, I do think these companies serve a valuable purpose. We would not have nearly the level of easily available credit in the US if it wasn't for them. And easily available credit leads to more home ownership, more small business startups, and numerous other advantages.

Without them you might have to wait a few days, or even weeks to get a line of credit. This is not a bad thing, in fact I would venture to guess there would be fewer problems if people DID have to wait for lines of credit. I just bought a house, the process is not lightening fast and you do not need instant credit to do it. And if someone is starting up a business on instant credit then they are not probably not thinking things through or planning very well.

Sure, it leads to some people drowning in credit debt as well, but that's due to irresponsibility on the part of both the person and the creditor -- in fact, accurate credit data is more likely to help avoid this problem than increase it.

Choicepoint has some major accuracy issues as well, so they are probably not helping there. In one notable case (referenced elsewhere in the comments) one person spent a week in jail due to Choicepoint's inaccurate data. I would venture to guess than since they are perceived as accurate, they actually make the situation WORSE by not being accurate. Kind of like how bad security is often worse than no security.

The issue is that consumers have little to no control over the data at this point -- you're only allowed to place a credit freeze in a handful of states (and the "warning" that you can place on your report is universally ignored). There's insufficient protections against inaccurate data. And getting access to your own report is still overly difficult (although it's improved greatly in the last year, now that everyone can get a free copy every year (twice a year in Georgia)).

What sickens me is that while protections are available, you have to pay for them. Not only do you have to pay for them, but you have to pay the people who are irresponsible with your data to begin with, thus necessitating the need for the protections. If that does not sound like a mob style protection racket, I don't know what does.

Finkployd

Now they need to do quality control

[meburke]

ChoicePoint is an aggregator. As much as 20% of their data could be inaccurate. Employers (for instance) make decisions based on ChoicePoint data, even though ChoicePoint "suggests" that they independently verify the accuracy of any negative reports. (Of course, it may work the other way also: 20% inaccuracy suggests that ChoicePoint will give subscribers false positive data, too.) Is this important? Well, Baseline Magazine wrote a nice article on this last year, http://www.baselinemag.com/article2/0,1540,1825320 ,00.asp
http://www.baselinemag.com/article2/0,1540,1825287 ,00.asp
and I was really impressed with the fact that a Home Depot employee spent a week in jail for crimes he did not commit.

Security is only half of it; Accuracy is the other half.

Pop quiz

[Rob T Firefly]

It's enhanced user ID and password protections--if employees forget their passwords, they must take a five-question quiz (example: "What year was your Social Security number issued?") to reset it; if they fail that, they must pass a 15-question quiz with a systems administrator.

I'm sure that makes everyone feel better and inspires lots of Holy Grail "What... is your favorite color?" gags, but as long as the info exists in records for someone to verify, it's open to being copied and used by the wrong people.

Non-US?

[mr100percent]

ChoicePoint has blocked access to its network from all non-U.S. Internet addresses, with a few exceptions that DiBattiste declined to detail.

To who? ECHELON?

Turn off the spin

[HardCase]

What repercussions? Did they lose business? Sure they got hit with a 10 million dollar fine but look at their financial statements, that is barely a drop in the bucket for them.

It was a total of $15 million, plus another $4 million in other obligations imposed by the FTC (like third party auditing). Insurance covered $11 million of the $19 million, but Choicepoint had to pony up $8 million of their own money. If you look at their financial statments, you'll see that it's no slap on the wrist - it represented half of their cash. In terms of yearly income, it's about 7% of what the company makes. Plus, I suspect that their insurer will either raise their liability insurance rates or drop them altogether.

I'd say that the penalty was fair. It's not necessary to drive the company out of business - just necessary to give them a sting so that they don't do it again.

-h-

Re:Turn off the spin

[Almost-Retired]

I'd say that the penalty was fair. It's not necessary to drive the company out of business - just necessary to give them a sting so that they don't do it again.

No, sorry, that doesn't cut it with this old fart. Until they are put out of business, and their database put in escrow for purposes of forensics traceing only, with it to be preserved on non-networked servers that it takes a federal court order to gain access to, such shennanigans will continue. While they're at it, I'd be in favor of the top floor executives haveing a hand amputated in the grand old arab justice manner. Maybe both hands for the President of such a company.

I frankly could care less about the collateral damages from putting many of such a companies rank & file people out of work, they knew full well the type of business they were working for. I cannot seriously seperate those people from all the 419 scammers in Nigeria. They're all birds of a feather. Put them out of business, mark them physicly for life and make it damned clear that this is what will happen to everyone that abuses the data they are in charge of. Then and only then will these leaches turn honest.

--
Cheers, Gene

Progress Indeed

[SupremoMan]

I have used Choice Point products at my last job. Following their little... ummm... mishap they changed my username (which they assign) from the first latter of my first name followed by my last name to random assortment of character. Progress indeed.

Their Other "Mistake"

[edward.virtually@pob]

When are they going to talk about their "mistake" in 2000 when they helped Bush steal the election in Florida by illegally removing blacks from the voting rolls? Or has everyone forgotten about that by now? It'd sure be nice to see some of these traitors to our country get their Constitutionally mandated punishment, vs. being interviewed in magazines.

Re:Their Other "Mistake"

[Gorshkov]

funny, that - I just read the article that you yourself gave a link to. FTA ..... the list supposed to be a list of felons from the state of Texas. Most of the people on that list had misdemeanors, not felons .... is that THIER mistake, or something you should be pissy about the State of Texas about? 2nd .... the article says that the law fobidding felons to vote unfairly targets minorities because it eliminates 31% of black men from voting. I would be VERY surprised if a third of black men in Florida were felons. And even if they were, again, is that "their" fault, or the fault of the state of Florida for having such a law on their books? If you want to dump on the company for doing something wrong, please, at least, pick on something they *have* done wrong. I have no further information on the incident you're talking about other than the article you provided a link to. If that article is the best you can provide to support your claims, then I'm afraid that your accusations are baseless.

Re:Their Other "Mistake"

[workindev]

The reason nobody is talking about this is because:

1) It's wrong. The US Civil Rights Commission failed to find a single person who was incorrectly removed from the voting rolls and not allowed to vote in the 2000 election because of the Felon list.
2) ChoicePoint had no authority or means to remove voters from the rolls. Only the local county election officials did. 3) That was 6 years ago, and most whiny liberals have given up crying about this non-issue by now.
4) Subsequent independent media reviews of the Florida 2000 election have all found that the outcome would not have changed using the existing rules that existed on the day of the election.

Re:Their Other "Mistake"

[workindev]

Its pretty clearly up to Choicepoint to provide accurate data, otherwise if there is no accountability they might as well just make up a bunch of names and use those instead.

Actually, no. Per state law requirements, ChoicePoint was hired (by Democrat Ethel Baxtor) to provide a list of possible convicted felons to each county, and each individual county election supervisor was required to verify the names on the list, provide an avenue for appeal, and ultimately remove previously convicted felons from the voter registration rolls.

If their source was bad, they should have either found another source to validate the data (they should be doing that anyway, it's just good practice to validate the quality of the data you sell -- it is pretty hard to believe that they did not have at least a general idea about the accuracy of the data) or they should not have reported it at all.

Again, they were not required to provide validated data. State law placed the burden of validating the names soley on the county election officials.

It was, by the way, the Democrats who wrote and voted for these state laws in Florida after the 1996 Miami mayoral Democratic primary, which was found to have widespread fraud.

What I learned from Their Screw-up

[PingXao]

Americans need an ammendment to their Constitution that guarantees them the Right To Privacy. Then, assumiung a Congress that actually follows the Constitution can be elected, in conjunction with the Right To Privacy there should be a law that prohibits the use or sale of my personal data without my prior consent. Better: it should be against the law to even collect and store that information in any database where the consumer - citizen, if you will - doesn't have the ability to "SQL DELETE FROM * WHERE NAME = ME".

Consider the Source

[ZWithaPGGB]

Ms. DiBattiste doesn't have a very good rep as a privacy advocate.