100 Million Victims of Data Theft

jcatcw writes "With the latest significant data breach — theft of a Boeing laptop with unencrypted personal information on 382,000 employees — the Privacy Rights Clearinghouse estimates that the total number of data breach victims has passed 100 million since they started tracking in February 2005. The director, Beth Givens, admits 'the number 100 million is largely a fictional number,' but it surely errs on the low side. Since California is still the only state with disclosure laws, incidents are difficult to analyze fully. However, Congress this week passed a bill requiring that the Department of Veterans Affairs report breaches."

Comments

I don't trust the article

[BadAnalogyGuy]

How can you trust the article when they make the outlandish claim that Boeing makes laptops. They make airplanes, silly.

Re:I don't trust the article

[extern_void]

Nah Nah Nah they make notebooks, those airplanes are just for undercovering!

We need to think how transactions are processed

[rolfwind]

Right now, it's becoming clear to me that the problem is that the weak chain in the link is that the creditors/banks/etcetera consistently rely on a few lines of data to complete transactions and identify the parties involved, 95% of which is publicly available, the other 5% easily stolen.

I don't know what to do to solve this, any suggestions?

(Way back when, my friend who worked at a Sam Goody used to actually check credit cards when customers bought something on his first day on the job. After the manager caught wind that he denied someone using their friend's mom's credit card, supposedly with permission, he got yelled at and told not to do it again. I can't help but think that the laws are too lax in this area and the industry has little interest fixing it.)

Re:We need to think how transactions are processed

[AoT]

Yeah, there's that problem; and also the fact that it is 100M known victims of identity theft.

On a side note, why is it that I get all these credit card offers from companies whom already have my SSN, I know you got it guys, and they tell me I'm "pre-approved" for credit, and yet I have to send all this info in?

Come on big brother! If'n you're going to know everything about me please dont make me fill out all the damn forms in triplicate!

Re:We need to think how transactions are processed

[Anonymous Coward]

I don't know what to do to solve this, any suggestions?

Do it the same way that you make companies care about any other type of public safety issue. Make it very painful for them if they fail to protect the data. If they lose privacy data they should be completely liable for any damages that occur. A couple of major class action lawsuits and we can make it so that companies won't want to collect privacy data except when absolutely needed.

Re:We need to think how transactions are processed

[Ajehals]

This is an old problem - the banks / merchants etc... want to make it easy enough for you to spend your money or to get credit that you do it on a regular basis. If banks decided to make it harder - in order to increase their / your security / privacy then it means that they lose business, especially if they are the first to do it. Basically they don't mind losing a bit of money to make a lot of money.

Of course as long as its easy to get hold of your cash or get credit, someone will want to exploit that to get hold of cash or credit in your name. So making it harder to commit fraud or identity theft is really only beneficial to the customer, which in turn means that the only path to making it harder to commit fraud or identity theft is to introduce legislation or regulation to make it happen. That of course is opposed by the banks and merchants (as they lose out) and opposed by the majority of customers as they don't see that there is a problem until it happens to them.

So yeah, apart from not seeing an easy solution for the banks and merchants, I also don't really see a will to implement any solution which decreases the amount of spending or credit applications, or one that will cost money to roll out (after all most organisations are looking at short term profit not long term strategy's).

Re:We need to think how transactions are processed

[bluefoxlucid]

I solved this problem ages ago. Some guy, actually two of them, invented something called the Diffie-Hellman Public Key Encryption Algorithm. Since then we've had dozens of these show up and now have RSA and DSA/ElGamal out there. Pretty much, with huge (1024 byte!) challenges and hardware devices with your key in them, as well as transferable One Time Pads (so you can let someone else use your credit card once, twice, for $5, for $10...), you can make it so everyone along the way can verify your identity and nobody along the way can pretend to be you.

The system drawn out isn't that complex. It's lazy distributed too; anyone can cache your public key, so anyone can independently verify you over and over again. This means that the store can verify your card isn't a spoofer and not pester the credit card company with it if it is; and if it's not, then the credit card company can also verify your card isn't a spoofer (and that the store isn't sliding in extra charges after you've signed for the price) and not pester the national PKI network with it.

Re:We need to think how transactions are processed

[Jessta]

In Australia the shop is liable for credit card fraud. So it is in the shops best interest to make sure that the person making purchases on a credit card are who they say they are.

The real problem is that the information that identifies you as you is the same information that you give to people to prove that you are you.
Giving anyone you need to prove your identity to all the information they need to pretend to be you.
What is needed is something on long the lines of public-private key cryptography.

Re:We need to think how transactions are processed

[marcello_dl]

Come on big brother! If'n you're going to know everything about me please dont make me fill out all the damn forms in triplicate! many things in life acquire a logic explanation using this axiom: banks want your property, bureaucracy wants your time.

Re:We need to think how transactions are processed

[dbc001]

This is a great point - I get annoyed every time a credit card transaction goes through and I don't have to sign anything. Don't they realize that without a signature there's no way to prove whether the transaction was me or someone else?

Re:We need to think how transactions are processed

[bl8n8r]

> I don't know what to do to solve this, any suggestions?

1) Address the ignorance factor first. Make sure people are aware of the issue of data security and the seriousness of it. Don't assume they automatically know. Explain it to them in a way that is informative and not condescending.

2) Use a platform designed to keep users in userland.

3) Setup laptops with encrypted filesystems [0] and encrypted connections [1]. Do not give users administrative access. Re-image [2] system partitions for extra freshness. Stop using WEP.

[0] http://rubyforge.org/projects/fusefs/
[1] http://www.oreillynet.com/pub/a/wireless/2001/02/2 3/wep.html
[2] http://www.feyrer.de/g4u/
      http://sourceforge.net/projects/g4l

Re:We need to think how transactions are processed

[TheRaven64]

Companies really need to start learning about security. My date of birth is not a good way of identifying me, because it's on the electoral register next to my name, and is publicly available (Gillette did some good marketing with this, sending a free razor to every male as soon as they appeared on it). Similarly, asking my for my mother's maiden name is not secure. Anyone who knows my name and date of birth can get this quite easily.

One of my banks has quite a sensible system; I select a password, but they only ever ask me for two letters from it (as well as asking for a five-digit pin every time). Someone passively intercepting this is not likely to be able to use the information they get. Unfortunately, their system is flawed because if you don't get it right, they ask you for the same two letters until you do, meaning that it only takes 676 attempts at maximum, and 338 on average (assuming no heuristics are used) to make brute-force it. Of course, to do this, they would have to have got my 5-digit pin (which is not used anywhere else), so it's not a bad system overall.

My US bank, however, is useless. In order to get my web password, I had to phone them and tell them the size of the last payment into the account. I couldn't - I wanted access to the web interface so I could find that out - but they were happy to tell me what it was if I told them my address (not exactly a secret). Once they had told me the size of the last payment, they wouldn't let me tell them that to get the web password; they had to transfer me to another operator who then asked me the size of the last payment. Once I told the second operator the information that the first one had given me, I had full access to everything.

Re:We need to think how transactions are processed

[planetmn]

Yes, they do realize that. The merchant has decided that the convenience of swipe and go will bring in more money than they will lose from reversed charges. For instance, I don't go to gas stations that don't accept credit cards at the pump. I don't want to wait in line to pay behind the idiot buying cigs and the idiot buying lottery tickets when I can go across the street, pay the same amount, and be out in much less time.

-dave

Re:We need to think how transactions are processed

[Anonymous Brave Guy]

Yep, absolutely. This is the way forward, and it's long overdue. Awards of 100% of real damages plus statutory punitive damages of $100 per victim per incident if negligence is demonstrated would do the trick real quick, I'd imagine.

Re:We need to think how transactions are processed

[Anonymous Brave Guy]

They realise it, they just don't care.

Typically, the vendor is responsible for the loss if they permit a card transaction and it gets challenged successfully by the card holder. If the vendor doesn't check the signature or PIN properly, it's not going to be the card company's loss.

The only major exception is if the vendor has correctly followed procedures laid down by the card companies to verify ID (e.g., collecting a signature and checking it against the card, or using the Chip and PIN machine). In this case, card companies typically limit how much a card can be used -- and particularly how much it can be used in different circumstances to the historical pattern -- before alarm bells start going off and the card holder gets a call asking them to confirm that the transactions are legit. I got such a call once just for using a credit card to buy a tank of petrol: I'd had the card for a couple of years, and usually used it only for on-line purchases of tech stuff, and according to the card company guy who called me, the sudden change to a use that's a favourite for casual card thieves was enough to trigger a confirmation call.

The upshot of all of this is that while a certain amount of money may be lost to serious fraudsters, it's a drop in the ocean compared to the total volume of transactions these companies deal with. Relative to reducing the number of card transactions in favour of either something less secure or just not doing the business, both of which would cost the card companies a fortune, the level of loss is considered acceptable. Whether you really signed for your shopping doesn't matter to them, because if you make what appears on a simple examination to be a legitimate complaint, then it's cheaper to pay you back your $15 or whatever than to investigate more fully.

Re:We need to think how transactions are processed

[FooAtWFU]

many things in life acquire a logic explanation using this axiom: banks want your property, bureaucracy wants your time.

WTF does a bank want with my property? Don't let's be silly. Banks want your money, not your property. They are, in fact, willing to pay you for your money (this is called "interest" on your savings account or CD). They're also willing to sell you money, at a slight markup, so as to obtain more money; this is known as a "loan".

But your property? If you've got a foreclosure on your mortgage, the bank isn't going to be too happy about it. They don't want this big old lump of property sitting around- a house that needs maintenance, property taxes to pay, stuff like that - and it isn't earning them that much income just sitting there. A loan, now, that earns them income. So how are they going to turn property into money? They're probably going to sell it for a sizeable amount less than its market value, and get back some of their money so they can loan it out again.

Re:We need to think how transactions are processed

[radtea]

Awards of 100% of real damages plus statutory punitive damages of $100 per victim per incident if negligence is demonstrated would do the trick real quick, I'd imagine.

Unfortunately, your imagination does not conform to reality. Punitive measures rarely have a dramatic effect on human behaviour.

This can easily be seen in actual data. Consider the death penalty.

North Dakota has one of the lowest homocide rates in the U.S. and has not had the death penatly since the 1930's. The homocide rate in Texas is ten times higher, and yet Texas executes people on a regular basis.

The rate of executions in Texas jumped from about 5 per year in the 80's to over 20 per year in the 90's, and this four-fold increase seems correlated with a ~20% drop in the homocide rate over the next decade, but no one who is arguing from the data, rather from their imagination, would suggest that increasing punitive measures is the best way to alter human behaviour. If a five-fold increase in killing convicted murderers brings about only a 20% drop in the murder rate, and yet making Texas more like North Dakota (but warmer!) brings about a ten-fold drop in the murder rate, an objective observer might suggest that we spend our resources figuring out what it is about North Dakota (or other north-central states, or Japan, or Canada, or Switzerland) that results in fewer people killing each other.

The data suggest that neither firearms ownership nor cultural diversity (Canada is one of the most culturally diverse nations on Earth, with criminal gangs drawn from the four corners of the globe all trying to set up shop here) nor punitive penalties are the most important differentiating factor.

And when one moves from the realm of individual to corporate malfeasence and negligence, it is more than clear that companies are willing to take enormous risks in the name of short-term profits as Merck did with Vioxx.

Ergo, whatever you might want to believe, the facts are pretty clearly in favour of punitive measures being a very poor way to influence human behaviour. They are sometimes necessary, but should be the last tool of social control that we reach for, not the first.

Re:We need to think how transactions are processed

[Anonymous Brave Guy]

For someone so keen on hard evidence, you're making a mighty big jump from what affects individuals who are screwed up enough to kill someone with a firearm and what affects a profit-making business. If you make something painful enough in financial terms, businesses will tend not to do it. Short of making the executives personally liable -- which would be no more constructive anyway by your own argument -- what better incentive would you suggest?

Re:We need to think how transactions are processed

[CodeBuster]

The technical merits of public key cryptography are not in question, but rather the understanding of the public with regard to the proper use of these methods is and that is the real difficulty. If you cannot make the system completely workable without any knowledge or understanding on the part of the public then your efforts will fail because average people do not, will not, or cannot understand the basis for public key cryptography enough to be informed users of the system. I have personal experience with the glazed over looks that I get from the corporate top brass when I try and explain these things to them and these guys are smarter than the average Joe on the street (although just barely it seems).

The problem with the specific system that you describe is that it is based upon access to the physical credit card, but many credit card transactions are processed each day without sliding the actual card (i.e. Internet and phone transactions with just the numbers keyed in). How are you going to fix that loophole without making it such a hassle for the user that they just go to the physical store instead? How about trying to explain to the average guy in the event of a failure (and there WILL be failures because no implementation is perfect) why he cannot buy airline tickets to his grandmother's funeral because his card did not validate with the public key of his credit card company for whatever reason (i.e. maybe the data on the stripe got corrupted or something else went wrong)? These are real problems and they are difficult to solve without compromising either security or convenience or both.

Re:We need to think how transactions are processed

[marcello_dl]

Federal reserve, BCE... all owned by a network of private banks. They print the money. Normal banks lend each other money, use fractional reserve, (from wikipedia: "Fractional-reserve banking refers to the common banking practice of issuing more money than the bank holds as reserves. Banks in modern economies typically loan their customers many times the sum of all deposits they hold.")

And money is not backed by gold. Money is essentially paper which is trusted to have value, and those who print this paper essentially from a private, self regulating organization. They literally can make how much money they need. Why should they be interested in having more paper? they're interested in doing something with it: get things, property, power.

Re:We need to think how transactions are processed

[newt0311]

Mod parent up for a very insightful post on the cost and gains of security. too bad I don't have mod points right now.

Re:We need to think how transactions are processed

[bluefoxlucid]

you cannot make the system completely workable without any knowledge or understanding on the part of the public then your efforts will fail because average people do not, will not, or cannot understand the basis for public key cryptography enough to be informed users of the system.

Lock the PubKey in a hardware device (a USB device, really). All transactions have to ping the device. The easiest way to do this would be to embed a small OS (Minix? You could do it in all of 12,000 lines of code probably) with a small piece of server software (with bare minimum functionality) that performed the operation. A NIC would be emulated over the USB port, so it'd look like a network device. Password checking, small keypad, etc., the user interacts when it wants something. Problem is the device becomes expensive (realistically you could do it in under $100; hell I'd wager you could get it down to $20 once the whole part is standardized).

Interestingly, you could probably wafer the whole thing onto a device the size of a credit card. Everything but the input device, of course; the CPU and the minimal ROM and RAM needed (this is a completely secure device!) could all be embedded into a really, really flat wafer chip. You'd have to make sure the card was absolutely stiff though; no flexing, twisting, or bending. The chip on the card could be made tiny by simply making it a hardware encryption/signing chip with embedded key; the above "Mini OS" and "Web Server" could securely run from the reader device, which wouldn't be capable of performing the encryption (can't access the key, it can just blurt data at the card and get it back signed).

As for input, the input would have to be directly on the reader device. If the input is in a terminal (cash register, computer), you have a point of failure (trojan keylogger).

The problem with the specific system that you describe is that it is based upon access to the physical credit card, but many credit card transactions are processed each day without sliding the actual card (i.e. Internet and phone transactions with just the numbers keyed in)

This is true. Home users could use a reader device; but there's another option. The home users could use OTP passwords. Consider you go into the bank, stick your card in the reader there (it figures out what credit card company the card belongs to), and it ID's you. You then customize some passwords; you get a print-out of a list of random passwords that will access your account exactly one time, each with a value you assign. So $*!114$e,@ might be worth $5; 5eue0[a# might be worth $200. These passwords are invalid the first time they're used; if you use 5eue0[a# to buy an 89 cent lollipop, you can't spend any more using that password.

When you make a purchase you shift several of these passwords across, along with your account ID (public key, which is public info). If an attacker compromises this, 1) he has to prevent your purchase from succeeding (lack of stealth); 2) he can only access so much money. You can also give these passwords to others to "lend" your card out; your girlfriend might buy gas, so you give her aa#1tE9^ and she can buy $20 of gas on your account.

This would seem strange at first to end users, but by no means difficult. The UI would be easy enough; go to the bank, give it a set of amounts and quantities (like $5 amount, quantity 4 gives you 4 $5 passwords), and it prints you a list. The credit company keeps a record of this; if you LOSE the list, you can cancel the entire sheet (authorization when you buy using these are instant; and you can be notified of anyone trying anyway). The instructions (printed on the sheet for convenience) tell you to cross off any password after use. No big deal.

The biggest problem, really, would be that people don't like change. Anything new, no matter if it's actually simpler or just barely more complex, is met with resistance. Many people won't even use online banking, either because "it's not secure" or "I don't understand it." In the same way, people will lack trust in this kind of system, or will immediately assume it's complex.

Re:We need to think how transactions are processed

[garwain]

My cards have no signature, but a clearly printed "Check Identification" on the back. I use my VISA almost everywhere, and estimate that I am asked for my licence maybe once a month at the most. A lot of people hang onto the card until I sign the slip, then pretend to look at both, then hand over the card. Then there is the occasional person who has neve heard of doing that. One guy told me that it was illegal to do that, and another refused to process the sale, until I called VISA on my cellphone, to ask if that could be done. I understand places like the gas station that I stop at every couple days to buy cigarettes, or the delli that I buy lunch at almost every day, since they all know me, but a grocery store where I seldom ever see the same person twice should really be checking the cards!

Personal Information

[Barkmullz]

I wish I was the copyright holder, and protected by the applicable laws, of my own personal information.

Re:Personal Information

[JoshJ]

This actually seems like an interesting idea and potentially a real benefit that could come of the bullshit draconian copyright laws in existence right now. Any lawyers know what's up with this?

That said I can see the downside, it "legitimizes" even more draconian copyright legislation- instead of relying on "Think of the artists!" they could rely on "Think of the identity thieves!"

Re:Personal Information

[drsmithy]

I wish I was the copyright holder, and protected by the applicable laws, of my own personal information.

Copyright is fucked up enough already. I shudder to think how legislation trying to do this would make it worse.

Re:Personal Information

[poopdeville]

Hi.

This must sounds silly, but does your uncle have an email address? If so, could you email it to sollaa@vfemail.net? I would really like to ask him some questions. In particular, I would like more information about this, and intend to contact a Canadian lawyer regarding the legitimacy of such claims. If all this works out, I want to move to Canada.

I could make a mint on my name, especially in a long, drawn out trial. :-)

Re:Personal Information

[cakefool]

I am interested in your ideas, and wish to subscribe to your newsletter?

Re:Personal Information

[jamstar7]

This could be the way to bring it crashing down.

Worth a shot, isn't it? What could possibly make it worse?

100 million.. six months ago!

[anilg]

That according to http://attrition.org/dataloss/rant/100million.html

The Data Loss Database - Open Source has almost 510 events and over 143 MILLION compromised records as of this writing. 100 million? Dudes and dudettes, we had that over six months ago.

reporting on this subject

[AlanS2002]

I have a feeling that more and more reporting on this subject is going to make thieves take a closer look at what they are stealing in future, thus making identity theft a greater possibility.

Re:reporting on this subject

[AlanS2002]

I think perhaps some restraint is justified on the part of Journalist's. Reporting the possible discloser of 382,000 peoples private information is one thing. Telling the world that there is a laptop floating around somewhere in Chicago with that information on it is another.

From TFA

[AlanS2002]

Yeah, there's that problem; and also the fact that it is 100M known victims of identity theft.

From the article: "A stolen laptop at The Boeing Co. has pushed a widely watched tally of U.S. data breach victims past the 100 million mark". Saying that the 100M people are thought to have had data disclosed about them is not the same as saying that 100M people are known victims of identity theft.

Why go with a guesstimate?

[zuiraM]

It would seem more logical to just sum up the known figures, and present them along with information about what areas they cover, making it clear they are minimum values. I'm pretty sure those totals would ring the alarm bells just as effectively for those who actually care about it.

How much of the information is...

[Crasoum]

How much of the information is redundant however? Is it 158 million American's, 158 Million people across the globe, or 30 Million people 5 times over?

I was counted twice!

[Aphoric]

I have been counted at least twice though. I am a veteran and got a letter from the VA with a previous theft, and that was just a few months after I got a letter from Boeing telling me that my info was stolen. Have not heard anything about this latest one, I do appreciate the free credit monitoring I get now, but I am not convinced it would do me any good if someone was really using my info. Plus it is only for one year, that is a relatively short period of time, the info has an unlimited life.

another announcement

[ILuvRamen]

the strangely named "Privacy Rights Clearinghouse" has just announced that they'll be showing up at one lucky person's house with a giant check with all 100 million pieces of personal data written on it in a really, really small font. I hope I win it!

Re:another announcement

[teutonic_leech]

Actually your joke gave me an idea. What they should do is to print out all 100 Million names (not the rest of the info of course ;-) on paper in 12 point type and present it to the new Congress in January. It's easy to quote these huge numbers - 100 Million or a Billion - nobody can really imagine how many that is. Print it out to get an idea how much potential damage we're looking at in the years to come.

The way things are going, it's just a matter of time until the personal info of anyone connected to the Internet will be exposed. The status quo is unacceptable - but somehow, no matter WHAT happens over here in the U.S. - it's always business as usual. How many papercuts will it take until citizens in this country start taking action?

I wonder...

[e-scetic]

I never read of anyone having suffered consequences as a result of someone losing their data. Why is that?

Doesn't it seem as if there would be a few major class action lawsuits, at the very least? You'd think every time data loss occurs on this large a scale, it would be followed by droves of people suffering from identity theft or fraud

Re:I wonder...

[suv4x4]

I never read of anyone having suffered consequences as a result of someone losing their data. Why is that?

Doesn't it seem as if there would be a few major class action lawsuits, at the very least? You'd think every time data loss occurs on this large a scale, it would be followed by droves of people suffering from identity theft or fraud


You're correct: theft or loss of a machine doesn't automatically mean identity theft.

First, the machine should be in a working state which is sometimes not the case.
Then, the criminal should realize there may be interesting info on the laptop (most would just format the drive and reinstall OS).
Then he should find it on the disk.
Then know what to do with it or who would be interested in buying it.

As you may suspect, this quickly limits the potential damage from such mishaps.

But there's the other side of the coin: the fact you don't hear of consequences may be a result of too delayed or still undiscovered frauds.

It's like bad food additives (like aspartam): they are deemed safe, simply because by the time damage occurs, noone can link the damage to the cause.

It's possible that people suffered but they either didn't know they data was stolen, how it was stolen, or that their problems are caused by identity theft.

It's also possible that the info is collected somewhere, ready to be abused, but the would-be-criminals are waiting for things to "settle" so they have greater chances of success with their activities.

So it's all very complex, but one thing is simple: keeping unencrypted critical info on portable machines you can easily lose possession of, is terribly bad. It's pure laziness and ignorance, and the solutions to this very basic layer of data protection, are simple and "there", ready for someone to realize they are needed.

I'm not very happy to see the government trying to react in "pieces" by demanding that veteral info breaches are reported.. Why just veteran breaches? I'm not a veteran from any war, is theft of my data less critical? It can be the place where I work, the site I shopped from or my bank: it really should be approached with a generic solution and not a bunch of untimely exceptions to an absurd status quo.

Re:I wonder...

[scdeimos]

I never read of anyone having suffered consequences as a result of someone losing their data. Why is that?

Because not many media outlets are interested in reporting on individuals who lose a few hundred dollars when they can throw around figures like 100,000+ victims in a single crime.

Well, the guess isn't that bad, really

[rockout]

The director, Beth Givens, admits 'the number 100 million is largely a fictional number, I suppose that's better than just tossing out a large, fictional number.

Re:Well, the guess isn't that bad, really

[Nymz]

IANAG (I am not a grammerian) but I think the point of the sentance isn't the size of the number, but it's value or state, and therefore the adverb form was used appropriately.

Protect yo'self

[jomama717]

A buddy of mine was recently affected by the UCLA breach and was lamenting about all of the precautions and protections he was required to put into place now that his SS# was likely in some scumbag's hands, and it dawned on me that he may have actually gotten lucky. He was awakened to the reality of identity theft without having to experience any tangible loss, and is now motivated to take the proper precautions. It then occurred to me that to not assume that my information was in the wrong people's hands didn't make any sense and I have taken the same precautions my friend did:

1. Access to my credit report/score
2. Big 3 credit bureau monitoring - notification of any new accounts or loans in my name
3. Personal case officer (through the bank) if something happens

These services can be purchased for anywhere from $5 to $12 a month depending on the bank. I suppose I could still get burned but I can't imagine any of it could hurt, well worth the money at any rate in my mind.

Re:Protect yo'self

[tgd]

It doesn't feel to you like you're paying protection money to the mob buying those services from your bank? A bank that is part of the problem because like every bank, they'll gladly loan money in your name with little or no verification?

If they wanted to protect your identity, they'd make it harder to steal. Companies losing personal information aren't the problem, companies who casually take action based on very little information that will impact you when that information is lost is the real problem.

"Identity theft" is a meaningless term

[Jonboy X]

First off, the term "identity theft" is completely ridiculous. No one is taking away who you are. Your friends and family won't suddenly forget who you are. A better term would be "credit fraud".

This is the basic scenario: A criminal poses as you to borrow money (usually with a credit card), and then whoever lent that person the money asks you to repay it.

Then there are generally 2 consequences for you: debt and reputation damage. The debt itself is usually the lesser of the two problems, since you're not legally obligated to repay money that someone else borrowed in your name. Reputation damage, on the other hand, is incredibly hard to repair. This usually takes the form of erroneous information on your credit report.

Private agencies (Equifax, Experian and TransUnion are the majors in the USA) maintain this information of your past financial transactions, and sell it to potential lenders in the form of a credit report. Lenders then use this information to decide how risky it would be to lend you money. These credit reporting agencies err on the side of over-reporting negative information, because a defaulted loan from an under-qualified borrower costs banks and lenders much more than a qualified applicant being turned away. Additional services (like providing reportees an easy way to correct errors) would cost credit reporting agencies much more than their client lenders would be willing to pay for the increased accuracy, so they don't bother implementing them.

The short version is that banks and other lenders knowingly rely on imperfect information about potential borrowers, because it is the most economically sensible thing to do. It's not profitable for them to pay for more accurate information. If they decide not to lend you money, even based on erroneous information, it will likely be very hard to change their minds.

Re:"Identity theft" is a meaningless term

[Fulcrum of Evil]

Yeah, every time this comes up, someone posts to object to the terminology. Face it, ID theft is what we call it even though it isn't literally true. They are, however, eroding your identity with various banks, so it's more accurate that you may think. Anyway, have fun tilting at windmills.

Re:"Identity theft" is a meaningless term

[britneys 9th husband]

"ID theft" is even worse. It makes it sound like someone stole your drivers license so they could buy beer. At least "identity theft" vaguely relates to what's going on.

Re:"Identity theft" is a meaningless term

[rastos1]

First off, the term "identity theft" is completely ridiculous. No one is taking away who you are....

If you are not the only one "Jonboy X" that can prove that he is "Jonboy X" than you don't have identity. You are left with plurality at best ;-) You had identity before and now you don't have it anymore. Sounds pretty much like theft to me. Of course it is not only about the name. If someone can succesfully pretend to be you - including your debt history, providing correct address, SSN, CC # and your /. account ... - how do we know it is you? We don't. You lost your identification.

Re:"Identity theft" is a meaningless term

[Jonboy X]

If you are not the only one "Jonboy X" that can prove that he is "Jonboy X" than you don't have identity. You are left with plurality at best ;-) You had identity before and now you don't have it anymore. Sounds pretty much like theft to me. Of course it is not only about the name. If someone can succesfully pretend to be you - including your debt history, providing correct address, SSN, CC # and your /. account ... - how do we know it is you? We don't. You lost your identification. It's not so much the "identity" part that strikes me as odd; it's the "theft" part. When someone steals your television, they have it and you don't. When someone "steals" your identity, you still have it because you're still you. It's just that now, someone else has some information that can be used to impersonate you to people who don't check too closely.

Maybe everyone should periodically be able to buy a public/private cryptographic key pair that can be used to authenticate you. The higher your net worth, the longer (and more expensive) key you buy. To buy something, you just encrypt the message "I bought a book from Jimbo Jones on November 19th, so please give him 20 bucks" and give it to the vendor. The vendor can decrypt the message with your public key to make sure it's really from you, and your bank can do the same when Jimbo shows up for his money.

Re:"Identity theft" is a meaningless term

[jimmichie]

First off, the term "identity theft" is completely ridiculous.

Yeah, it should be Identity Sharing.

Re:"Identity theft" is a meaningless term

[bky1701]

"A better term would be 'credit fraud'."

I much perfer "some-moron-is-buying-stuff-with-my-money-and-i-am -going-to-get-blamed-all-because-some-stupid-compa ny-can't-use-blowfish-i-hate-this".

Re:"Identity theft" is a meaningless term

[raynet]

Or how about Identity Infringement? I googled for Copyright Infringement and got this:

Copyright infringement occurs when a person copies someone else's copyrighted items without permission. This would also include public display of a copy of copyrighted work.

After small modification it actually sounds quite ok to me:

Identity infringement occurs when a person copies someone else's identity without permission. This would also include public display of a copy of identity.

Ofcourse using that copied identity to get a loan/buy something/etc wouldn't be Identity Infringement but a fraud.

Re:"Identity theft" is a meaningless term

[berzerke]

When someone steals your television, they have it and you don't. When someone "steals" your identity, you still have it because you're still you.

Except the damage they do de-values you being you. Say you had a great credit score and were about to buy a home. Oops, now you can't get approved for the home loan because of all the black marks on your credit score. Can you honestly say that doesn't make you less valuable?

People have spent thousands of dollars and years trying to clean up after an identity theft. Is that de-valuing you. That money and time could have easily been put to better use. That's value you have lost.

Re:"Identity theft" is a meaningless term

[Vengeance2001]

I work in the financial services industry and I totally agree with the parent post. Banks and credit reporting agencies are doing what is most financially efficient for themselves, which is not reducing errors to zero, but reducing them to a number they can absorb the risk on, while foisting some of that risk on to consumers as well.

In reality though, 99% of that risk is still on the banks. Most credit card fraud isn't using your personal info to get a mortgage in another state, but simply making some charges for tennis shoes or trades of gasoline for cash at a truck stop. The issuing bank of your credit card eats this cost when you call them and dispute the charges. It is off your bill in seconds. The reason they can eat the cost is because they are getting half of all the interchange charged on your card, which is usually 1.5% to 2% of your charges. Trust me, they make a fortune. They can afford to eat the fraudulent charges.

What they have done now is brilliant marketing. They have convinced a large portion of the general public, including much of /. it seems, that this large scale mortage/loan fraud which ruins your credit is a very likely occurrence. Of the 100 million+ victims of identity theft, how many actually had enough happen to hit their credit report, or had additional loans and foreclosures happen? I bet less than 1000. Perhaps less than 100.

But instead, the banks hype this as a huge issue and get you to what... pay a monthly fee to "protect yourself". Now instead of them offsetting their lost transactions from fraud with interchange from your purchases, they are making $120/yr off of you for THEIR failure to authenticate you properly, selling you on the "service" to outsource to YOU their job in detecting the .01% case someone takes out a loan in your name.

This is a huge scam and I'm surprised /. people haven't seen through this by now.

Re:"Identity theft" is a meaningless term

[jimmichie]

Or how about Identity Infringement?

Or better, Identity Cloning, as in phone cloning. Identity Infringement could be an effect of Identity Cloning, but it isn't the act itself.

Also the word "cloning" has that nicely sinister sound to it - crazy scientists and their two-headed cows, the word "Attack", etc.

I found out last week I might be a victim.

[artifex2004]

The university I graduated from reported someone had hacked in and gotten access to about 6K student and faculty records, including payroll info.
Their idea of taking care of the problem? Wanting me to register online (!!) or over the phone to be told if I was one of the victims, and also to get a free credit report or get credit monitoring, though they don't seem to think they should pay for that or for any fees I might get if I have been victimized...

Oh, and I only found out because it was in the local news.

Re:I found out last week I might be a victim.

[aplusjimages]

Man they are really taking care of business. Is there no liability on their end for not taking the proper measures to at least inform all the victims of the problem?

Now the new scam email line will read.

[Overkill Nbuta]

Your User number 100,000,000 Claim your prize by sending in your credit card info as well as full name!!!! Be quick this is a limited time deal!!!!

Re:makes me wonder...

[davaguco]

On Europe we have a common Directive (that means its the same for all countries and it sets common guidelines that must be made into law by each nation) that establishes some measures that must be taken to protect all the personal information. On my country, companies are not allowed to store customer's personal information on a laptop, for example.

in other news...

[fedork]

estimated 347 million people are victims of made-up statistics.

Stolen from Car

[brajesh]

"...was stolen from an employee's car earlier this month"

Seriously, who carries around a Laptop with "Personal Information" of 382 Gazillion living, dead and zombie employees in a fscking Laptop and leaves it in a car unattended.

You would think they would store this information in a so-called safe server somewhere and have policies on not taking them around in Laptops. Why would you need that information on a laptop anyway ? For fsck sake - We're talking about serious personal information!

I say hire stewie to shoot this guy.

In other news - why no mention of India in this whole game of data theft ?

Re:Stolen from Car

[B4D BE4T]

For what it's worth, the data wasn't supposed to be on the laptop and the guy was fired for going against company policy.

Re:Stolen from Car

[B4D BE4T]

Oh and in case anyone is interested in reading the full response from Jim McNerney (Boeing's CEO), here it is.

Possession is nine points of the law

[shanen]

In this case, we should possess our own personal data, and unauthorized possession should be theft, just like someone broke into your house and stole your computer. I have about 300 GB of storage at home, and I'm quite sure that all the personal information that companies 'own' about me could easily be stored on MY premises.

hmm

[Falladir]

Soon everyone will have been victimized, yes?

Re:makes me wonder...

[Skidge]

It was probably some schmuck trying to make an unreasonable deadline for some reports, trying to put in a few extra hours of work at home so he doesn't get yelled at by his PHB, who didn't give said schmuck the approval needed to get a secure remote connect because it would have cost his department a few extra dollars.

Stupidity

[Lavene]

A laptop containing the personal information on 382,000 current and retired workers of Chicago-based Boeing Co. was stolen from an employee's car earlier this month, according to Boeing spokesman Tim Neale. He declined to say exactly where the laptop was stolen. That really sums it up. You will never ever have better security than what the stupidest person with access to sensitive data can muster. Leaving a laptop with such data unattended in a car??

You can enforce encryption on every file, strong passwords etc but sooner or later some smuck will print it out and forget to schred the printout when done. So it ends up on some dump available to anyone crawling around looking for something usable.

Designers of company security forget the most obvious and most dangerous threat: stupidity! My personal favorite quote used to illustrate exactly that is the following:

When the infamous "ILOVEYOU" email virus hit, I saw TV news coverage that included an interview with some bubblebrained company secretary. At one point she said, "Oh, I saw we had dozens of these emails coming in, and of course I was suspicious, but I had to open just one of them because, you know, 'I Love You!' *giggle* I had to just see what it was about, you know?" You can't foolproof a system, you simply need to get rid of the idiots. Which sadly is easier said than done...

Yeah, But when they do...

[Anonymous Coward]

....They'll really fly!

Fines?

[kosmosik]

What are the fines in such situations? This is clearly they fault - the've taken personal data and haven't took enough care of it (in fact they were stupid enough to feed that data into laptop and get it stollen). What does US law says about it? In Poland (European Union) they would face severe consequences.

How many people here have had or know personally..

[b.burl]

...their identity stolen? This computer fear thing smacks of the whole terrorism scam. How many people here inside the US have been or know personally someone who has been the victim of terrorism? The media, for whatever reason, seems to want to amp up the fear quotient of this nation. I bet that stolen wallets/physical mail account for ten thousand times more id fraud than any computer activities, yet that doesn't get headlines. Nor does the fact you are more likely to die from an accident in your bathtub then you are from a terrorist attack. "300 000 000 Million Potential Victims of Wallet Theft!" or "Your Bathtub: Friend or Insturment of Terror!" are a couple of headlines I'd like to see.

Re:kill me, Slashdot, for I haven't the nerve myse

[poopdeville]

I realize this is probably a troll, but I'm responding in case it isn't.

It isn't too late. But you have a tough choice to make. You can either choose to make your life better, or choose to let life push you around. Changing is not easy.

Read Sartre, Camus, Nietzsche.

Pull your ethernet cable, unplug your wireless router. Take some time off of the /b/ scene. Get out of town for a while if you can.

Think about your goals -- both the failed and incomplete. Ask yourself why the failed ones failed. Resolve to fix the problems that caused them to fail. Evaluate your incomplete goals. Make plans to finish them. Commit to your plans.

Exercise is good for you. I don't mean to make fun of your belly. But you obviously need to become stronger to become the man you want to be.

Don't sweat being bald.

You've wasted a lot of time, but you're still young. There's no point wasting any more.

For the love of God...

[RulerOf]

Two words: Terminal Server.

I know it has been asked before, but WHY in the name of GOD does this kind of information need to be on a fucking laptop?!

My mother works at a VA hospitol and as such, has access to read and modify all the personal information necessary to commit identity theft on thousands of patients, and of course, she has a laptop computer issued by the hospitol so that she can work from afar. When she originally received it, it was nothing more than a Win2k box with VPN software, MS terminal services. All of the sensitive data was/is stored on the servers on their intranet. After a small "upgrade," the laptop was returned, only this time it came back with a full encryption setup. The interesting thing is that there is STILL no sensitive data stored on the laptop. It is, however, just as easily accessible. The point is, if someone stole that laptop, no sensitive data would be compromised, even if the encryption was broken (which probably wouldn't happen).

I don't fucking understand, why when we have the technology READILY available to completely prevent this kind of crap, that it isn't used. A shout out to all the companies on this planet: Centralize your damned security. Laptops cost $500. This kind of shit publicity and potential lawsuits cost a hell of a lot more.

I dunno

[BadAnalogyGuy]

Do you really think they'll take off?

Re:I dunno

[MarkRose]

I predict they'll be a flying success!

Just a thought.

[Toreo asesino]

This case would make an excellent case-study for the Vista Bitlocker facility. The cynic in me wonders whether Microsoft may play on this convenient timing.

They don't know actually

[Sycraft-fu]

The people who send you preapproved offers have very little info on you, pretty much just name and address. Basically they ask one of the credit reporting agencies for a list of people falling within a given set of criteria. They then send offers to those people. IF you want to take them up you have to give them more info and they get a full rundown of your credit and decide if they still want to give you credit, and if so on what terms (you can be turned down for preapproved cards).

You can opt out of this if you want, you have to contact the credit bureaus and tell them to quit giving out your info for this and they will.

Re:makes me wonder...

[R2.0]

And of course, all European companies follow the laws scrupulously. So no one EVER puts such data on laptops. So if a company laptop goes missing, there's no reason to worry (or report it), because there couldn't POSSIBLY be personal data on it - why, that would be illegal!

I smell BS

[mangu]

I actually have an uncle who copyrighted his name and also became his own "sovereign nation"

I've heard many stories about your uncle, he's the Baron Munchausen, right?

By obtaining a drivers license you are agreeing to abide by the motor vehicle laws. If you don't have a drivers license and you know what you are doing, they can't touch you for breaking any of the laws

Your story would go well as a light comedy movie script, but it doesn't stand the hard test of reality. That's not how democracy, or any other form of government works. Laws exist to be obeyed by everyone, you cannot claim that you don't agree to abide by them. In the case you mention, driving a vehicle in a public road is a privilege, not a right. You are granted that privilege under certain circumstances and that privilege can be revoked.

Re:I smell BS

[IpSo_]

I figured it was all BS too... Until my uncle started actually doing it.

Keep in mind I get this information 2nd/3rd hand usually... Take a look at this site explaining how it is done with regards to income tax in both US and Canada:

http://www.detaxcanada.org/

I just heard another story of my uncle latest adventures... The last three times he has been in court (he defends a bunch of other people as well) he just takes a color laminated photocopy (intended as a copy) of his (or the defendants) birth certificate, walks into court, when called upon goes up and hands it to the judge and walks out of the court room. Thats the last he hears from them.

The reason for this that I understand is that the vast majority of laws only apply to "fictional entities", essentially a birth certificate. By handing over your birth certificate to the judge, they can prosecute the fictional entity all they want, it has no consequence on a "person in the truth".

Again, call BS all you like, thousands of people do this sort of thing every day, and it just keeps growing. It works in both Canada and the US. But you NEED to know exactly what you are doing. Any Joe Blow can't just do this, they need to study law for several years usually first.

Identity is not abstract data

[mangu]

When someone steals your television, they have it and you don't. When someone "steals" your identity, you still have it because you're still you. It's just that now, someone else has some information that can be used to impersonate you to people who don't check too closely.

I would agree with you if it was about copying data such as software, music, films, etc. But if someone has all the data that identifies you, he can effectively take it away from you. He can change your address so that all your mail goes to him and not to you. He can have a new driver's licence issued so that the picture in the DMV will be his and not yours. Without too much effort, he can make it so that *you* will be the fake.

Of course, if all you have are debts, that will not matter too much, but what if he uses your identity to sell your assets? What if he takes a mortgage on your property? Or what if he sells your real estate, he could even sell your home and disappear with the money.

Yes, I believe that, differently from intellectual "property", an identity is something that can be stolen.

Re:makes me wonder...

[Dunbal]

why the hell is our information on something as portable as a laptop? Where the hell does it need to go?

      Obligatory: Information wants to be free? It was trying to break free?

Its Bigger than just Credit Fraud

[HighOrbit]

I agree that "identity theft" is an over-used term when "credit fraud" might be a better description in most situations. However, I've heard of "identity theft" that didn't involve credit fraud. During the immigration debate that was going on last summer, I read a story in the newspaper (sorry, don't have a link) about a woman on the east coast who applied for unemployment benefits, but was denied because records showed that she was currently employed somewhere in the midwest. Except, she wasn't working in the midwest; some illegal alien was using her SSN. There have also been cases where the IRS has audited people because their tax returns do not match the income reported for their SSNs (again, probably illegal aliens using stolen SSNs).

So even if an "identity thief" doesn't apply for credit in you name, they can still cause you major problems.

CA isn't the only state with disclosure laws

[vox_gabrieli]

The poster says, "Since California is still the only state with disclosure laws..."

Been in a cave for the last few years? See http://infosec.uga.edu/policymanagement/breachnoti ficationlaws.php for information on 34 state breach notification/disclosure laws.

Real World

[blacknblu]

The article pertaining directly to Boeing stated the following:

Although the laptop was turned off and was password protected, Neale said the data on it was not encrypted.

My point is that how many people know how to access this information, or better yet, know to even look for this type of data on a stolen computer? I can see some kid trying to get into the laptop for a couple of days, and subsequently reformatting the hard drive. I don't want to imply that this information can't easily be compromised, and exploited, merely that I don't think this is very likely. Boeing's primary concern should probably be the other confidential information that was on the laptop. Don't they contract with the government?

Yes, But...

[Nom du Keyboard]

number of data breach victims has passed 100 million

Yes, but, how many are dupes?

Not Just California Has Notification Laws

[idsfa]

As of last July, 34 states had laws requiring consumer notification. Some are triggered directly immediately upon the loss, others only if the data is considered "at-risk". It's hard to take TFA seriously when it can't even get basic facts correct that can be found in less time than it took to write this comment ...

help "them" to want to change

[martyb]

THE PROBLEM: It is currently financially worthwhile for some companies to play loose with personal information. The perceived costs of the consequences of poor protection are not sufficient to warrant a change in their way of doing business.

Many merchants / agencies / whatever don't seem to want to provide us additional protections. All it would take is for a few companies who already take security very seriously to sign up for the best star rating listed below, chalk it up to advertising expense, and put the pressure on the other merchants who do not sign up. "Hey! *WE* take your security seriously, and we put our money where our mouth is. If *WE* mess up, we clean it up and pay *YOU* for your inconvenience. Why would you want to deal with anyone else?"

There is a financial opportunity for an enterprising group to make a fortune here. Existing insurance companies provided graduated coverages and fees depending on certain items. I can select how much liability insurance I want for my car. I can pay the insurance company a larger premium for a greater amount of coverage. Alternatively, if I have certain protective measures in place, then my premiums can be reduced. I choose the level of coverage that works for me.

whenever there is a security breach, make a payment to each CONSUMER! Get the consumer to be your best ally in getting merchants to sign up for the protection. So, if a merchant compromises the security of MY information, then the insurance company sends ME a check. I'll leave it as an exercise for the reader on how this could be extended to cover other organizations that have access to personal info such as hospitals or government agencies.)

Also, and VERY important: advertise this feature like crazy - get the consumers to push the merchants to get the coverage along with an easy-to-remember grading scale for consumers to use to assess the degree of protection they are provided by a merchant. It took a few years, but now US car companies are advertising the NHTSA crash test ratings. I expect the same could work for credit protection.

NOTE: All dollar amounts are pulled out of a hat. I'm just trying to put something concrete out there to use as a starting point for discussion. Obviously, the size of the covered merchant would affect the premiums and payouts, and I have NOT worked those into these numbers. Please offer improvements! The examples listed here might be appropriate for a moderate to large merchant.

Have a graduated scale of costs and coverages that depended on what level of security measures were in place at the time of the loss / theft.

• PROTECTION LEVEL: ONE STAR:
  If a merchant takes no security precautions then the insurance company would:
  • charge high premiums: $10M per year, plus $10 per covered client.
  • require high deductible: $5M deductible (in escrow).
  • provide low payment to each consumer: $100.00 to each consumer.
  • provide limited credit monitoring protection: 6 months of credit reporting agency monitoring.

  The consumer gets some benefits, even if the merchant makes no great effort to protect the user. It's still better than anything that the consumer is now getting. After a few payouts, word-of-mouth will boost interest by consumers in seeking out at lest this minimal coverage. CEOs and CIOs will start to take notice.

• PROTECTION LEVEL: TWO STAR:
  If a merchant takes certain, documented, security precautions ( encrypted DBMSs, firewalls) then the insurance company would:
  • charge moderate premiums: $5M per year, plus $10 per covered client.
  • require moderate deductible: $1M deductible (in escrow).
  • provide better payment to each consumer: $500.00 to each consumer.
  • provide better credit monitoring protection: 1 year of credit reporting age

Re:makes me wonder...

[ytm]

Yes, they follow the law. Otherwise they face fines (companies) and jail (people responsible for personal data security or lack of it).

I have worked in one of European national telecoms, I had access to full personal data of millions of our clients. Our computers were locked down so we couldn't copy the data on floppy/cd/usb. The network was tightly separated from the rest of the company intranet not to mention the Internet. Our office was monitored.

Before even touching the keyboard for the first time we had two full days of lectures about the relevant personal data protection bill, internal company rules, how to behave in case of security breach and so on.

Yes, personal data security is taken very seriously here. It always amazes me why with you don't have similar set of laws in the US.

Re:How many people here have had or know personall

[jorghis]

I know several people who have had their credit card numbers stolen. Its actually fairly common and by far the most common form of identity fraud. Why do you think you see so many ads on TV about protection from having your credit card numbers stolen? Its because that shit happens all the time and smart people care a great deal about being protected from it.

Re:How many people here have had or know personall

[b.burl]

Seriously? By so called hackers? Or was their mail stolen? And where is the hard data on numbers of police investigations resulting from credit fraud vs numbers of police investigations resulting from credit fraud caused by computer malfeasance? As to why you see it on tv, you see a lot of terrorism stuff (only talking about the US here) and that is virtually unheard of. Paranoia is the life blood of our media.

Re:How many people here have had or know personall

[jorghis]

Not hackers so much as Phishers. (I assume you are familiar with this) Huge amounts of money is lost every year by people who submitted their credit card info or paypal password to authentic looking websites. I (and prettymuch everyone I know) routinely get emails from "paypal administrators" or "bank of america customer service" asking for info.

I have always tried to impress that paranoia you are looking down on onto people I know when it comes to stuff like this. Trusting these spam emails or giving any sensitive information to sites you arent damn sure are legit is prettymuch gauranteed to make you a victim of identity theft in short order. My grandfather was a victim of phishing when he got spyware on his computer and a popup appeared offering to sell him software to get rid of it for $30.

That being said, I am not sure what the ratio is of theft like this versus theft from the waiter at dennys writing everything down on a napkin when he goes to run your card. I think it is a safe assumption that neither is nontrivial however.

If you are telling people who are highly computer illiterate to trust that noone is going to steal from them on the internet and everyone else is just being paranoid then you are doing your friends/family a great disservice.