Slashdot Mirror
Bill Introduced to Congress Would Allow ID Theft Restitution
verybadradio writes with an article at News.com about a bill introduced into Congress that would allow citizens who have been victimized by identity theft to seek repayment for the money and time spent repairing their credit history. The bill was introduced by Democrat Patrick Leahy of Vermont and Republican Arlen Specter of Pennsylvania. "Last year, 8.4 million Americans were victims of identity theft, and many were left with a bad credit report, which takes months or years to repair, the lawmakers said ... The bill would also eliminate a requirement that the loss resulting from damage to a victim's computer must exceed $5,000 for prosecution; make it a felony to use spyware or keyloggers to damage 10 or more computers; and expand the definition of cybercrime to include extortion schemes that threaten to damage or access confidential information on a computer."
...a cyber-crime bill that seems to be actually useful. Did we step into Bizarro America?
"Useless organic meatbag" -HK-47
It all sounds good except this line makes me a bit nervous:
and expand the definition of cybercrime to include extortion schemes that threaten to damage or access confidential information on a computer.Would threatening to expose a security flaw in a server or website unless it was patched open you up to prosecution under cybercrime laws then? I know that's already fairly shaky ground from a legal standpoint, but would this make it even worse?
Curiosity was framed, Ignorance killed the cat.
So are you telling me that no other laws actually forbid any of these things already? What's wrong with those laws?
My usual reaction to identity theft laws is "Aren't existing fraud laws sufficient?"
At least at first glance, however, this bill seems to be doing more, and doing it in a useful manner -- not solely a "well, let's make it more illegal!" type of bill.
a bill introduced into Congress that would allow citizens who have been victimized by identity theft to seek repayment for the money and time spent repairing their credit history.
If they set the damage levels anything near what the RIAA got in their last downloading lawsuit, that would put the brakes on ID theft right quick.
The theory of relativity doesn't work right in Arkansas.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
...cries out for an approach similar to the combating of piracy back in the 1700 and 1800's, eg) issues of letters of marque, allowing private citizens to capture or do damage to the criminals.
Now if only the penalties for stealing a person's identity, money, and ruining their credit history for years could match the penalty for having a certain flowering plant in your pocket, maybe the court system wouldn't be such a joke.
Would threatening to expose a security flaw in a server or website unless it was patched open you up to prosecution under cybercrime laws then?
If you ask for money in return for keeping your mouth shut, you are already an extortionist. At the same time, it's hard to see them using the bill to come after an honest disclosure, where you simply published details. Must find bill to know.
DMCA, Hollings, Palladium. What might have sounded like paranoia is now common sense.
I was the victim of identity theft about 6 years ago. It took me literally 2 years to clear my name. That's 2 years of making long distance phone calls, tracking down the right people, emailing, photocopying birth certificates and licenses, making police reports, etc, etc. All the while I was looked at with suspicion and I basically had to prove my innocence!
Whose fault was it that my identity was stolen? That would be the credit bureaus and the credit card companies that allowed it to happen, not me. It is their system that is at fault for allowing people to steal identities so easily. So why am I responsible to clean up their mess? If I have marks on my credit report, I should be able to tell the bureaus and that should be the end of it. I think restitution is the least they can do.
It should be 10 computers, as in one more than 1 computer.
man, I feel like mold.
The real problem is that, as very well predicted, the use of social security numbers for anything other than social security will lead to all sorts of problems. The fact that a person's identity is essentially just this number and that the credit game has become an entrenched part of commerce and culture, they [the people behind the illegal use of social security numbers -- yes, it's illegal -- law was written to prevent this and everyone, including and especially the IRS has ignored it] have created a situation for which "they" should be held liable. Instead, they create the mess and we are somehow responsible for cleaning up the messes. And now with bills like this, the idea that "we" are responsible for when THEIR credit and identity systems are abused and used against us... that "we" can somehow prevent it from happening and it's our responsibility.
The abuse of SSNs and the credit system at large needs to be dismantled or severely reformed in such a way that the creators of the problem are liable for the problems it causes. As it stands, they can buy and sell "your information" because it's not your data... it's theirs... they collected it! But when it's abused and affects your life, YOU are responsible. How is that appropriate? NO. This bill is VERY wrong. The bill should assign liability to the parties responsible for creating the mess. This is just further effort to assign the liability of the SSN and credit industry to people who may not even be willing participants!
Basically, someone impersonates me. Some bank/merchant/credit card company extends credit without verification. The impersonator defaults. They report me as the deadbeat. That is the scenario. The creditor who mistakenly reported me should be liable for slander. The credit reporting agencies should be considered accessory after the fact. So the real culprits are the people who extend credit without verification and people who report me as a deadbeat without justification. Normally if they have to face full consequences of their action, they will clean up their act and we would not need any special laws for identity theft.
But congress in its infinite stupidity holds the impersonator the responsible for my ruined reputation. The impersonator is liable for lying, cheating, committing forgery and is responsible for all the damage caused to the credulous creditor. And if they call me a deadbeat without proper verification whoever reported me as the deadbeat is responsible for the damage caused to my good name.
As usual it is a credit reporting agency liability protection act being sold to the public as an anti-ID theft law.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Leahy did release the PR blurb on it, but the full text is kept secret of course (Dems want to get paid too)
Track the bill here: http://www.govtrack.us/congress/bill.xpd?bill=s110-2168
Obama likes poor people so much, he wants to make more of them.
These issues have been plaguing Credit companies
1. Your premise is wrong. The banks DO NOT assume the costs of fraud. Merchants absorb all of the cost of fraud and pay the bank a penalty too. The costs are shifted to consumers through higher prices. Bottom line: The Association banks benefit greatly from fraud.
2. The bill in question is the wrong way to address the issue. The card associations have a solution to the problem except they won't implement it because it cuts into their fraud revenue and the costs are much higher per-card than dumb plastic/mag-stripe. The standard is called EMV. It solves 98% of fraud issues. Today. The other 2% I'll blame on bad coding.
http://www.maxineudall.com/2010/02/should-economists-be-sued-for-malpractice.html
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
The bank was the fraud victim, you're collateral damage. Er, um, no pun intended...
After the fraud uses your personal information to take money from a third party creditor, said creditor unfairly trashes your reputation, since that's the easiest recourse they have. Actual damages inflicted by the creditor in what looks to me like a defamation case might well be difficult to demonstrate, but not impossible: that nasty little clause in your credit card agreements that makes everything go to 31.99% APR if anything derogatory appears on your credit report means the defamation is costing you actual cash.
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
Re: Identity theft
People need to be notified whenever an application is made for a drivers license, bank loan, etc. Until the rightful owner of the SSN responds (eg. via telephone with a PIN), the application cannot proceed.
If people are dumb enough to carry their PIN in their wallet then they should be liable for all losses.
Re: credit cards:
I'd like to see:
a) No storage of credit card numbers by *anybody* other than the card issuer (ie. online merchants like must not store your card numbers anywhere, you need to type it in for each transaction).
b) Any credit card transaction over $100 requires secondary verification (eg. PIN, token ID).
c) More than (say) five credit card transactions in a single day triggers a verification requirement (talk to credit agency on phone, give password, say everything is Ok).
This sort of thing will never happen until the credit card companies become liable for losses. When it is done then the liability can be shifted to the people who didn't look after their PIN, etc.
PS: You can carry PINs securely - I had an account with a bank which gave you a little card with a grid of colored squares on it. The idea was to write the digits of your PIN in positions you'd remember then fill the rest of the grid with random digits. It worked beautifully - I could safely carry my PIN in my wallet and I never forgot where the PIN was. There's no reason why something like this couldn't be printed as standard on the back of all credit cards instead of the stupid signature strip which is too small to sign properly and nobody ever looks at anyway.
No sig today...
If a person uses a stolen Social Security number to get a job, I would like to see all FICA contributions made by the employee and employer to remain credited to the identity theft victim, even after the fraud is discovered.
That the victim will someday receive larger Social Security checks would be some consolation.
[Yes, this measure would have a negative impact on the illegal immigrant population, because few other groups have any reason to use stolen Social Security numbers when applying for a job.]
That that is is that that that that is not is not.