Slashdot Mirror
Should Companies Share Criminal Blame In ID Theft?
snydeq writes "Deep End's Paul Venezia criticizes the lack of criminal charges for corporate negligence in data breaches in the wake of last week's Best Western breach, which exposed the personal data of 8 million customers. 'The responsibilities attached to retaining sensitive personal identity information should include criminal charges against the company responsible for a leak, in addition to the party that receives the information,' Venezia writes. 'Until the penalties for giving away sensitive information in this manner include heavy fines and possibly even jail time for those responsible for securing that information, we'll see this problem occur again and again.' As data security lawyer Thomas J. Smedinghoff writes, data security law is already shifting the blame for data breaches onto IT, thanks to an emerging framework of complex regulations that could result in grave legal consequences should your organization suffer a breach. To date, however, IT's duty to provide security and its duty to disclose data breaches does not include criminal prosecution. Yet, with much of the data security framework being shaped by 'IT negligence' court cases over 'reasonable' security, that could very well be put to the test some day in court." It's a slippery slope to be sure, but where should the buck stop?
If they do not, who will?
I think it is entirely appropriate to investigate a company when large ammounts of personal information ends up being 'stolen' ... If it turns out that the company did not take the necessary steps to protect people's personal information they should face some consequences. At the same time, there has to be an understanding that even the best technologies available and best practices may not prevent all personal information theft so a company should not face harsh consequences if they took the necessary steps to protect people's information.
This would be a great civil class action case, but criminal? The slope is quite slippery, and like previous posters have said, the cops don't do much when it comes to non-violent, non-domestic, non-street crimes.
Of course, some would argue that the banks and lenders behind the whole sub-prime mortgage crisis deserve to be criminally punished for causing a global recession and for the number of lives they've destroyed.
If a COMPANY is being prosecuted criminally, you obviously cannot have jail time, because it's a non-person.
However, you can (and IMO should) have much stiffer penalties than civil courts allow. When a data security breach is so bad to as harm society itself, it should be prosecuted criminally - this is the doctrine for criminal prosecution of companies. Criminal penalties can range from massive monetary damages, to shutting the entire company down, or forcing changes in management. This is the correct route to go.
Obviously, if the implication is that the IT workers themselves should be thrown in jail, this is absurd and would cause all kinds of damage, both foreseeable and unintended.
If you can read this... 01110101 01110010 00100000 01100001 00100000 01100111 01100101 01100101 01101011
I'm reminded of what that guy from Jurassic Park said: 'I don't blame people for their mistakes, but I do ask they pay for them.'
You have a choice, allow organizations to report the data breach, or have them cover it up to avoid the penalty.
[ Why would anyone report a data breach when that means they would face jail time ? ]
Remember, the odds of an external entity finding out about the data breach is extremely small (except for the ones taking the data of course ).
Almost any system can be hacked by someone sooner or later. If a crack was found in SSH that allowed a root shell, would the person responsible for the code be held responsible? or the guy who admins the server?
Not only should there be criminal damages, but attempting to keep the thieft secret should carry an even heavier penalty.
There should also be, upon conviction in criminal court, monetary redress for the poor slobs whose data was compromised, and it should be a LOT more than it cost the compromised person. Say, enough to buy a new car.
Why can't we have the death penalty for corporations? The standard answer is "all those people who get trhrown out of work", but there IS a death penalty for corporations; ENRON suffered the death penalty, but the people in charge (at least the ones that didn't go to prison) suffered no penalty at all.
How about a "death penalty" where the victims are given the company itself?
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
If your going to store my private data without my expressed permission. In other words I didn't specifically request it (as opposed to having it thrown in as a caveat on some user agreement). Then you are responsible for all mishaps that may be incurred by your actions.
If I ask you to save my data then I accept that I am giving permission to said company as is. In other words it now is my responsibility to look over all disclosures.
The inherent problem however is there is no means of specifically identifying a person. first and last name no longer work. you can assign them a unique code but most people get tired of bringing around and ID card for every business they do business with. Thus you are forced to use a.) a phone number which is subject to change, social security ID, or credit card number.
So though I do believe they should be held responsible for negligence and saving information without expressed permission. I do think the credit industry as a whole is responsible. There needs to be a fixed ID system which is separate from the credit system (as in credit score) and governmental ID systems.
This one ID bullshit needs to stop. Each person should have a superficial ID which can be changed at request. A credit ID which requires in person transactions (loan etc) a government ID and a health care ID. all of which should be maintained by different independent agencies.
The legal distinction between civil law and criminal law is that civil law is intended to redress a grievance between two parties or organizations, whereas criminal law involves the punishment for an action considered to be injurious to society as a whole.
In this case, these disclosures/leaks lead to widespread identity fraud, which victimizes many many people (not just the individual whose identity is stolen, also banks, merchants, people who may be scammed by the imposter, etc.)
So I'd say, yes, this action (lax IT security) can be considered harmful to society as a whole.
The IT department is likely completely unable to set policy, and cannot be responsible for the incompetence of call-center type workers.
Fines against IT-level individuals will just cause the companies involved to outsource their IT, and won't solve any of the security breaches.
By holding executives directly responsible, they will be forced to make the correct decisions at the hiring, policy, and training level.
Stop giving out credit to every person who walks up to a cash register. Stop warehousing critical information that can be used to apply for credit. Stop approving credit based on only Name/SSN/Address. Stop this culture of unlimited, unchecked credit to anyone, any time, any place.
The problem is the lending system, not the fact your data is leaked. In web terms, credit applications need to be double opt-in, not single opt-in.
Camping on quad since 1996.
If it's negligence in case of the company then it does make sense to sue the company. No employee should be running around with a laptop full of SSNs and addresses around (even if they are encrypted). That's negligence and the full force of the law should be brought on those people.
If it's due to a physical theft, say a burglary, you can't do too much about it. You can only review your procedures and make sure it doesn't happen again.
The worst is when companies fail to report it. They're the ones who should be sued to hell and back.
Help a man when he is in trouble and he will remember you when he is in trouble again.
Sure...while we are at it lets put a cop in jail every time someone in their city gets mugged, murdered, raped, etc.
I will be exiting the field the moment some kind of stupidity like what is suggested goes in place. I have a family, and I have no intention spending time in jail being a scapegoat for something like this. It is stupid to expect an individual to be held accountable criminally for something like this. Why should I spend time in jail or face fines personally because Vendor X couldn't be bothered to employ better programmers or test their stuff. Nevermind there will ALWAYS be vulnerabilities. Or maybe I go to jail because some worker brought in an infected USB photo frame. The only way you can really secure the desktop computer completely from the user is to cut the power cable and give them a pad of paper and a pen.
That said...I think there should be something to "encourage" companies to actually invest the resources in protecting that data, or just to stop collecting it. Seems to me not collecting it is far easier and more viable in many many cases. I agree that there is a problem in the value that data provides the company and their lack of "encouragement" to protect it. The notion of holding already overtaxed administrators criminally liable will only make the problem worse. The field will shrink even further and I imagine many of the competent ones will find work elsewhere not wanting to be a whipping boy under idiotic laws like this.
The only change I can believe in is what I find in my couch cushions.
It would appear to me that big companies don't consider personal info to be as valuable as something like thier trade secrets. I work for a large manufacturing company, and If I were to lose any data storage device with a large number of confidential details about our manufacturing processes or data/drawings of our parts and products, I would expect to be thrown under the bus.
If a laptop or hard drive or thumb drive with some personal info gets "lost" or stolen, anyone in the company who knew that said data was stored on such a portable and and easy to steal/misplace sort of device should be sent to prison simply for being an idiot.
Now, if the data is lost through a an attack on secured servers, and the company did thier due diligence to protect that data (multiple layers of security, multiple auths, firewalls, IDSs, etc..) then they shouldn't be punished, but if data is lost simply due to someone being stupid, then they should pay dearly.
i have a roll of electrical tape.
Corps will see the inside of a court room only if your name is the title of a song and the personal info gets posted! (MediaSentry will "Find it")
Currently in the US, Corps have more rights than you or I even though they are considered "A Person".
Corps that inadvertently/intentionally kill people at most must pay a fine.
If you or I do this, we don't even get the option to pay our way out.
Until this changes corps can do what they want.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
In socialist England the gov't gives it all away free!
So let me get this straight. We're going to give IT the shackles, when 9 out of 10 times, they are doing what they are told?
In my experience, IT has very little control, but all of the responsibility. Management of the company set the rules, even if the law is in favor of securing the data, that doesn't mean the managers allocate the budget to ensure that happens.
IT workers rarely stand up and say "I refuse", because when it comes down to it, it is their mortgage on the line.
Now it'll be their mortgage, or their freedom? Awesome, where do I sign up?
I disagree with the prospect of placing blame directly on IT/IS. I do believe however that much of the blame needs to be placed at the company level. Many times the risks are known ahead of time by both IT and the business, but the business has decided not to spend the money to fix the problem and have signed off on the risk. Sometimes there is nothing further the IT department can do without the express permission of business. In fact, this is fairly frequent.
I also disagree with this blame being in the form of a crime, unless it is negligence or gross negligence. Fines maybe, but jail-time no. The exception to this, is if the theft is an inside job. Of course, there are already laws to deal with that.
I'm a professional engineer (PE). My wife is a physician. I we screw up, ruining somebody's life, we get sued.
IT is not more complicated than medicine, yet seems to fail at security all the time. Perhaps it's time for malpractice/negligence to whip companies into shape.
I am not sure that criminal charges are necessarily needed. Who would get the jail time? I mean does the SA have to prove that he recommended better security to the PHB? Does management automatically go directly to jail?
I might be happy enough with the company being responsible for any identity theft of the people listed in their data. Maybe only for the next 5 or 10 years, but if their credit starts getting messed up, then the company which lost the data should be responsible to take the blame and also partially (split between the bank and the company) financially responsible.
Even that suggestion has issues though. People will then fraud the company that lost their data by pretending that their identities were stolen and that someone is purchasing things in their name. All the while it was that person themselves.
Regardless, I think the whole identity/information theft thing is more complicated than most (non-technical/non-business) people take into account.
Confucius say: "Man who associates with smarter men than himself is smarter than the men he associates with."
That would suck for the small web developers who can't pay for insurance for this sort of thing.
Directors and High level execs should be first on the jail cell lines unless they can prove that they;
1) Listened to reasonable IT security concerns (it's not their job to do the research),
2) Properly funded and supported efforts to insure data protection.
And yes I have been involved as low level IT support, a Director and an high level exec.
Most forms of construction must adhere to a code. Why should software be any different?
It would be nice, IMO, if we could formulate a set of minimum requirements for any kind of personal-data-handling software (including codes for operating procedures). Things like "all passwords in the system must use strong encryption" and "backups of the data cannot be stored on personal laptops" and the like.
Then legally require businesses to higher some ratio of software developers who have passed a code certification and logged sufficient hours under the apprenticeship of a certified master, and cite them if any such developers blow the whistle on them.
It is not a perfect solution. It has problems with implementation. And of course M$ will do its darndest to ensure that codes require the use of its software. But it it is still better than the situation we have now.
Forgive me for not RTFA in advance but...
I'm a developer, I've worked on many an app that has stored credit cards, social security numbers, and other pieces of juicy data. I've always acted with integrity and you'll never find a credit card or social security number posted on the Internet of my own free will. Generally I take best efforts to secure this information. Using appropriate technology such as hashing, encryption, access controls and authentication as appropriate for the information, etc. Documenting as throughly as possible to make sure that nothing happens, and what to do to further protect things.
Despite all this, if my programming is ever compromised, am I now jail potential? I'm finding a new job...
...in bed
Leaked data, by itself, isn't a crime in this regard. No harm comes to anyone until someone with criminal intent actually does something to it. Not counting, of course, the harm of feeling appropriately uneasy as you wonder if/when someone will do something with it following a leak - but I'm not sure that sort of anxiety rises to the level of crime on the part of the hotel chain... you could have the same anxiety about whether or not someone holding your data will at some point have a leak that hasn't even happened yet, and likely never will.
There's a reason that someone who sues McDonalds over the hot coffee she dumps in her own lap doesn't ask a DA to go after them criminally. Likewise with slipping on a wet restroom floor that doesn't have one of those "caution" signs put up by the maintenance crew. Being bad (or even, unlucky) at your job could well be grounds for a civil suit, but it isn't usually - and shouldn't usually - be considered an actual crime. That's pretty dangerous stuff, there.
When some wackadoo in full-on tinfoil hat mode brings a gun or a knife to work and kills the PHB he's hated for years, and is now convinced is working for Alien Overlords... is the employer who didn't see that coming an accessory to the crime that was committed, for having failed to prevent it?
If data is leaked, and no crime (based on the use of that data) is ever committed, and the laptop gets recovered with no expectation of it having been compromised... did a crime take place, not counting the person who ripped off the laptop from an employee's luggage? Is the employer actually a criminal because that happened? The opportunities for Really Bad Precedents here are vasty.
Don't disappoint your bird dog. Go to the range.
I mean, I know HIPPA takes care of issues with respect to people's medical records, but, I don't think that there are actually any laws against the release of people's data. If there were, there would be a whole lot less of companies out there that held and traded in such information.
It is a crime to break into a computer to gather this data. But, I don't think at this point, in the US it is a crime to lose it.
If I happened to have a database of people's information, and I want to freely publish it, I don't actually think there is a statute against me doing that.
If there is, can someone cite it or give links on this?
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
HAHA... you obviously don't know about Karma. You'll be modded to oblivion, until you give up your posts in frustration. No dissenting opinions allowed.
/. groupthink!
Long live
Agree that IT is the one that owns access to the data in question. But security is a organizational matter and should include data security - just like protecting other intellectual property. This should be mandated by the top management and verified.
SOX legislation is around for a reason and it is not the journal accountant who is held responsible. It is the CEO.
I'm of the opinion that the liability should depend in part on whether the data's being kept longer than needed for the transaction or purpose it was provided for or not. For instance, if I buy something from an on-line merchant they need to keep my name and address on file at least long enough to ship my item, and almost certainly for the length of time I'm allowed to return the item for a refund or replacement. They need to keep my credit-card number on file long enough to authorize it, possibly long enough to settle the charges (depending on how they're set up with their clearing house), and possibly as long as I'm allowed to ask for a refund (if for instance the clearing house requires the card number to credit the money back). When a company keeps information around longer than needed, they should be held to a higher standard since now it's their choice that the data's being kept. And "needed" should be determined by the purpose or transaction the data was provided for, not by what the company wants to do. When I provide a billing/shipping address for a purchase, I'm not providing it so the company can do better advertising later. If they insist that I create a profile and leave that information on file permanently for their convenience or benefit, they should be taking more responsibility for it's security than if they're keeping it just long enough to do what I asked of them and then discarding it.
Does it fall on the IT department for possibly having lax security procedures or using problematic software?
Does it fall on management who approves or dictates the security levels and procedures, and/or may exempt themselves from the procedures?
Does it fall on the software vendor who provided the software with a security hole?
Where does the blame fall?
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
Best Western claims that it was a single hotel, and that they purge older data when it's not needed.
Of course, as it's been so widely reported, the chances of people believing anything other than the worst case scenario is unlikely, as how many blogs are going to post a 'oh, nevermind, I was wrong' article? (and the newspapers would hide it somewhere on page 24)
Build it, and they will come^Hplain.
Syndeq, You suggested any form of accountability/responsibility for a corporate entity. What are you, some kind of commie scum? The ability to perform any level/kind/etc of illegal, amoral, corrupt, or otherwise-unacceptable conduct while under the 'name' of a corporate entity, then when you get caught to say "Hey man, it was the company!" to avoid blame, is the cornerstone - nay - the single most essential principle of the US economy. After all, harder to bring "Acme, INC" to jail then "John Doe" isnt it? In all seriousness, as long as the illusion of "corporate personhood" exists, we'll never escape this reaganic ideal of responsiblity-free wrongdoings.
You can't just say the IT department is at fault in all cases. It would have to be looked at on a case by case basis and it certainly wouldn't just be IT. The company as a whole can determine how well an IT department runs.
If a company flat out does something stupid then of course there should be some sort of compensation or punishment for the company.
Why should this only apply to companies? Why not government employees, heads of departments, or for those countries that have them, ministers of various departments?
It can't be so that a set of actions that should not happen give criminal liability and is morally condemnable if you do them as a private person or a company, but invokes the +5 Invisible Adamantite Brick Wall of No Traceable Responsibility if the government does them. That would be unfair and discriminatory for no good reason.
Company data practices share some of the blame. But why are they gathering and retaining the data to begin with? Like a clean desk policy at a bank, companies should be required to purge credit card details, most contact info, Driver's license numbers, SSNs, etc after a transaction is concluded. As soon as you decide to retain data, it will be broken into someday, and there ain't no Great Wall of China that's going to keep 'em out. Charging IT professionals criminally in this scenario is like charging overworked housecleaning staff with entropy violations.
You can always tell when you hit upon someone's real motives. To these people it is not a question of the law, but how the law may be manipulated to further a socialist agenda.
No taxation without representation.
And its converse: No profit without responsibility.
The latter also covers cases like Monsanto, which wants to profit from the wind blowing their GM seeds to other fields (sue the farmer for using the seeds without paying), but denies responsibility when those same seeds cause problems (contaminating the crops of organic farmers). If you want to be the beneficiary of a product or mechanism, they you must also be liable for any negative consequences of that product or mechanism.
This should raise to the same level as accounting fraud. Without regard to the details of the security breach, the various CxO's and the board of directors should be held to be ultimately responsible. In other business entity configurations, it should be the ownership group. Leaving this up to self-policing and even trade group policing just is not working. I don't believe the majority of organizations take infosec, and customer privacy in particular, nearly as serious as they should and they won't until they are looking at spending some time in jail. I also feel that this responsibility should not be 'firewalled' by contractual agreements between firms, i.e. Company A contract with Company 2 that looses the data. Company A's mangement/ownership should be on the hook just as Company 2's is.
RE: It's a slippery slope to be sure, but where should the buck stop?
If someone steals something from me, whether held in trust for another or my property, and does something bad with said property, it is the STEALER who should be criminally punished.
However, depending upon the arangments with the owner, if I'm holding something in trust for another, I could see that other person should have a right to persue me if I failed to protect the property in a reasonable manner.
In Texas (and in other states, it seems), it is against the law to leave your keys in the ignition. I haven't yet figured out exactly what the purpose is for that law, except to remind people that leaving your keys in the car invites theft. I certainly haven't heard of anyone being prosecuted for the "crime".
Perhaps a similar nominal criminal sanction should be in place for the company that leaves the keys to my identity in their corporate "ignition"? The penalty would be a slap on the wrist, or less -- because a stiff penalty would lead to coverups. But the law would still be on the books.
That would allow the bean counters to add an item on the balance sheet for "secure client data -- compliance required by law". That would carry more weight than "secure client data -- compliance with 'best practices' guidelines".
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
I agree with a previous poster, new technologies are difficult to follow, etc. However, that's ultimately not a good excuse.
If we begin to set standards, laws and consequences (that are enforced) then we'll see some change take place.
Companies are less likely to go the extra mile, if they don't feel they are legally compelled to.
Personally, if I were one of the unfortunate people who's identity was stolen, I'd be pretty angry at the negligence, talking to a lawyer and pursuing these companies.
What the UK needs is for the government to get the bill for breaches ;-)
Seriously, the Information Commissioner has actually served enforcement notices on the most incompetent departments and the Conservative opposition has called for prosecutions.
http://rocknerd.co.uk
The vast majority of computer security "incidents" we hear about, and most of the ones we don't hear about, would never have taken place if this was the stance adopted 10 or 15 years ago. Not IT liability... corporate liability. Ultimately it's the corporate level where goals and policies are set and approved, and budget decisions reign supreme.
If the first large-scale data security breach that happened to a retailer or a bank had been made into an example, we wouldn't be seeing what we see today.
have some sort of confidentiality agreement. If they do not live up to that agreement then they should be held liable. If they promise to keep my data confidential then it is their responsibility to implement the necessary security to actually keep that data confidential. I especially think hotels, car rental agencies, airlines or anyone else that requires that I transmit a cc number in some form or another, need to be audited and approved for security on a regular basis.
God will know His own
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
Lawyers do it, Doctors do it, Engineers do it, We should do it too.
We need a set of rules that the head of data security must live by for his job or else FIRED.
Legal decisions are up to lawyers and judges who don't understand what we do and why we do it. That's just dumb. If we create our own rules that we must abide by first we get to decide on the rules, second we can rule/pass judgement on it, third we can enforce it as we see fit.
No need for "laws" just rules we control and execute.
There seems to be something being forgotten here. In any pure game of cat and mouse, the cat always wins. The game ends when the cat catches the mouse. There is no end-game scenario for the mouse "gets away". When it comes to securing something, physical or electronic, the game of cat and mouse becomes the game of cops and robbers.
In any pure game of cops and robbers, the better funded group always wins. When it comes to physical property, robbers need to break locks, sneak in, sneak out, and escape capture. Furthermore, physical property can often be recaptured, and destroyed property can typically be repaid. But when it comes to electronic data like credit card numbers, there's no returning it once it's been exposed. There's no escaping or sneaking, or transport.
Obviously, exposing people to criminal charges when a robber breaks into your home is incredibly stupid. But it's even worse if you go down the road of charging corporations when they are exposed to electronic theft.
I think it's pretty fair to say that Ethan Hunt can steal anything from anyone. There's always some way to break in, or coerce someone on the inside. Right now, the only thieves willing to do so are those with experience, ability, and something to gain.
Hmmm, break into my competitor's database, and my competitor goes down. Hmm, break into that other company's database, and their stock drops. It very quickly becomes worthwhile to do so. All you've done is add one more way for the criminal to benefit from the crime.
So how about stiffer penalties for the criminal? The cause of theft is not opportunity, it's motive.
And the concept of IT security negligence is little different from bank physical security or workplace safety negligence.
If a bank is robbed, of course you go after the robbers. But if the robbers cleaned out your safety deposit box, and it is shown that the bank was failing to use best practices with respect to security, you have an action against the bank as well.
If you suffer a workplace injury, and it can be shown that the company was not following safety regulations and requirements, then you can go after the company.
Why is IT negligence different? If you aren't following known best practices, then that is quite simply the standard definition of negligence. "Did know, or as a professional should have known. Didn't do it anyway. BZZZT! Thank you for playing."
Really, this is one place where the law developed over the past several hundred years applies perfectly to today's technology without much adjustment at all. It would be great if all technology law were such.
In the UK (and, I believe, Europe), anyway.
The Data Protection Act briefly states:
It's not clear which country the Best Western incident took place in but if the systems were hosted in the UK and they processed bookings from UK customers, it looks like a fairly cut and dried breach of that law to me.
There is, however, the minor issue that I don't think anyone's ever been successfully prosecuted for not having inadequate security systems in place...
I don't think criminal prosecution is the way to go. It's bad, but typically I'm not a fan of making incompetence in private matters criminal.
What I do believe should happen is twofold:
1) Any breach should come with mandatory disclosure and civil liability. Basically, we should be able to get a class action suit going for the time and effort necessary to change all of our card numbers, etc. in the event of a breach, plus costs for checking credit reports, etc. I'm sorry, but my credit card company changed my card number four times in a year on account of "breaches", and I could never find out who the hell it was. It's a sometimes expensive inconvenience when you're on a trip, don't get the notice, and suddenly your credit card stops working. Or the hours spent changing over all of your automatic bill payments. Considering I make around $70/hour when it's all said and done, my time cleaning up their mess is not cheap, and I expect to be able to bill them for it.
2) If the credit card companies were smart, they'd levy serious increases in the fees they change to process cards from any processor or retailer that causes a breach. Or, better yet, cut them off entirely from processing until they passed a rigorous security screening. The idea of losing potentially weeks of business due to your payment processing being cut off would definitely motivate better security.
Basically, I don't see the need to bring in the slow, grinding wheels of the criminal justice system. A few adjustments to laws governing civil liability and disclosure requirements would very quickly make the industry adapt to much greater security.
What's a crime is that companies which issue credit cards, auto loans, mortgages, etc will accept your name, ssn, and mother's maiden name, as proof of identity.
These items just aren't secrets anymore so there's no reason for banks (etc) to go on thinking that only the "real" john smith would know them.
Banks that lend out money in my name should be forced to absorb resultant losses themselves. Equifax and trans union should be targets for libel lawsuits when they ding your credit rating because of ID theft.
The blame should be shifted to the companies who lose the data. Hopefully doing that will get them to question their procedures of collecting the data in the first place. What really needs to happen is a serious reform in the way credit is issued. It's one thing to have a data breach. The real problem comes in when that data is then used to open accounts. The financial institutions need to do a better job of identifying the people who are asking for credit. If a company wants to give me $10,000 worth of credit, they should pay the expense of having someone come to my address on file and have me sign something saying that I really want the credit.
Better than fining companies for security breaches, why not require a certain amount of security based on the type of data the business is collecting. Allow for periodic and random inspections and issue fines if the company isn't up to the required level. If theft occurs, a more detailed inspection is conducted until the cause of the theft is identified and fines can be issued if the theft should have been avoided by following the required security measures.
This is essetially what would happen if you allowed fines and class action lawsuits with the current system. The difference is, the 'fines' would be replaced by insurance premiums. It workers or departments would have insurance the same way doctors and investment advisors have malpractice insurance. The end result is the same, premuims would go down if you improved security or held less data. They would go up if your security was found lacking or you begin tracking unnecissary information.
Wonder how that works if my car is started with a toggle switch because the real ignition switch went bad... Is it illegal to leave my toggle switch on the harness?
As all decisions end up being their responsibility in the long run.
Crap may run downhill, but legal responsibility runs uphill.
At least in a world set in reality, that's how it should be...
Of course, they'd claim "we didn't know" and try to weasel their way out of it....
Who is general failure, and why is he reading my hard drive?
Negligence does not imply criminal culpability, gross negligence in some circumstances can involve criminal penalties, but to make negligence conduct a basis for penalizing computer security professionals criminally would discourage companies from making rational decisions regarding information security and discourage qualified individuals from entering the profession.
It is easy in the extreme to get sucked into an offer for work in an IT department that is, as it turns out, totally dysfunctional. Discovering the extent of dysfunction and extricating oneself from the situation can easily take a year. Do the browsers here seriously want to put themselves at risk of becoming criminally negligent every time they accept a job offer?
What a complete non-answer. Your reliance on flimsy "necessary steps" is exactly why the industry is dealing with these problems right now. What is necessary? If I'm transporting disks with your data on it, does it have to be a secured armored vehicle, or is a lock box enough? Can the guy carrying it be a convicted felon, or a minimum wage security guard? If I have your data on my laptop, does it have to be encrypted. Is an 56 bit DES algo enough or does it have to be the most modern encryption scheme available? Who sets these rules and are they enforced only after data loss ( or are there periodic audits?
The credit card industry has identified similar problems of responsibility in its business process and implemented a standard that companies have to comply with if they want to avoid being responsible for major losses (PCI). A good example of private industry trying to solve a problem without government regulation (albeit setup mostly so the few credit card companies can push financial losses back down to the merchants and vendors).
Sure it is. She wore 'provocative' clothes that enticed the rapist to commit a crime he otherwise would not have committed had she worn more conservative attire. If she were wearing conservative attire and was raped anyway, she should not have been out in the street alone, or after dark, or in that neighborhood. If this were 'date rape,' then she shouldn't have dated this schmuck in the first place. Didn't she do 'due diligence' and check him out? If not, why not? If she didn't know all these things, then she SHOULD have known them. It is not as if she were never told. The tools to make her more secure have always been available. Did she have a whistle? No. Did she have mace? No. Did she have a gun? No. Doesn't she know judo? No. She ignored all the well known tools that have been available for years to make her secure and went out without a single one of them. Whose fault is that? It is her responsibility. And she certainly should not have made the ridiculous mistake of being a woman in the first place.
Obviously she aided and abetted that crime and she should be charged for it to the fullest extent of the law. If there is no appropriate law on the books, we should make one. It's time to make these women accountable for the crimes they cause. These crimes WILL NOT go down until we stop looking at the symptoms and start addressing the root cause of rape in the first place: Women.
How about a moderation of -1 pedantic.
Don't most of these companies usually have you sign an agreement of some sort (I don't know if it constitutes a "contract," per se) which states something to the effect of, "(Company) will not share your data with other entities, barring partners of (Company)?" So, wouldn't providing your data to a non-partner, whether intentional or otherwise, constitute a breach of contract? (or agreement, or whatever.) I doubt any of these companies are going to claim the thief was acting in good faith. If they were to claim such a thing, they wouldn't have to disclose the theft, I imagine, and thusly we'd never hear of it...
Just a thought. Of course, I would never expect such an argument to stand up in court, especially against a big corporation. Still, can anyone who doesn't have to use the IANAL disclaimer comment on this notion? :)
-G
Their may be a grammatical error, misspeling, or evn a typo in this post.
But I do think that if companies A, B, C, D, and E have all lost your information, and then some ID theft that costs you $100k is perpetrated with that information, that all of them should have to pitch in $20k to fix the problem (since you probably can't tell which company's breach is directly responsible).
If they don't like it, they don't need to hold onto the information.
Best Western now says only a handful of records were compromised, not millions. Data security investigations are complex, and they require patience. As we learned from the TJX experience, it is easy for the press and for authorities to over-react. --Ben http://legal-beagle.typepad.com/wrights_legal_beagle/2008/08/credit-card-iss.html
Benjamin Wright, Dallas, Texas, benjaminwright.us
I am hopeful that criminal blame in serious situations will make corporations thing twice.
As soon as keeping data on people will become a liability, companies start to reduce their 'people information' to a bare minimum.
What we will see is that corporations will think twice about what information they keep and how they keep it.
As soon as criminal blame comes in play, closing holes in the access to customer information will get a closer look by SOX auditors.
It happens way too often that companies gather information they do not really need.
I have no problem telling stores my zipcode for them to figure out where to build the next store (hopefully closer by my home), however, phone numbers, email addresses etc. are beyond me.
Also, the reason why personal customer information needs to be in a non-secured location (i.e. laptop) remains questionable, maybe this is the only remedy to get some sense into the corporate world.
I am hopeful that this will have a positive effect on mailing lists and other marketing related activities.
Load New Commander (Y/N)?
Why are people shielded from the law when they start a company? Find out who broke the law and punish that person. Penalizing a company just makes its customers have to pay more.
Maybe, maybe not, but I bet you'll have an "interesting" conversation with the friendly officer if you get pulled over for speeding!
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
The USA needs something like the Data Protection Act which the UK has... It gives individuals rights to access and correct data held about them and it mandates that organizations must take adequate steps to protect and secure the data. Failure to do so is a criminal offense.
IANAL... If any of Best Western's compromised data details reservations at any of Best Western's hotels in the United Kingdom, they may have opened themselves up for prosecution under this law. All organizations and businesses in the UK which may store details on more than around 500 individuals must register and adhere to the DPA. I am sure that Best Western has had more than 500 customers in their UK operations!
No sig. Move along - nothing to see here.
Place the blame on the PHB's they are the ones who control funding and put on jobs add that cut out people who don't 5 years with one small piece of software but are real good with the rest of the stuff that they need.
Sarbanes Oxley mandates tracking, understanding and responsibility for financials. It should not be too difficult to define a standard set of practices that include yearly security reviews, updates and reports including recommendations by IT that must be signed off by corporate officers. If companies were forced to take this seriously, by the threat of fines, and this information were visible to shareholders they would be more likely to take it seriously.
We should keep our personal data in "memory banks", which are the fewest possible storage places, to which anyone else accessing the data must go to get it. Let the memory bank store an Access Control List, too, of who can access whose personal data, and the credentials for each access transaction. Then, those who access it just have a reference to the master data, and their own login info.
The memory bank spends its time and money protecting its data from getting cracked. It should be someplace with enough expertise and insurance that it can both protect from cracks, and pay to clean up the damage when it is inevitably cracked sometime, for some amount.
In fact, a regular bank's network, or even an insurance corp, sound like a good place for the master copy. Because people already trust them with their life's savings. If people want to take over their own data records, so the pointers all point at their personal storage, that should be an option. But their own insurance and liability will probably be higher cost than if they let experts do it for them, like every other info transaction we depend on.
--
make install -not war
If you've got a laptop, what have you got on it? Probably you've got some kind of address book with phone numbers and physical addresses. You might have a pile of old e-mail stashed away somewhere -- that old email probably has a whole lot of personal information in it that isn't yours. You probably aren't maximally paranoid about securing that stuff either, since you are the only person using that laptop.
Question is, are you a criminal if someone steals that laptop? Hell no.
I'd also ask you to consider how diligent you'd be about informing everyone in your address book that your laptop is stolen.
If you are a real professional, you are personally liable for your work. Real Engineers, unlike "Software Engineers", administrators or programmers can be sued for defective work. Once people can be sued this makes the professionals who have to carry E&O insurance.
Basically I don't think anything will change until this happens. At which time we will see many incompetents leave the field of IT.
Criminal liability is only for people who break the law, not incompetents.
putting the 'B' in LGBTQ+
I don't know if there are any additional updates, but as of yesterday, Best Western is disputing the extent of the breach, saying it only affected some guests at one hotel, not millions. FWIW, link only for reference, got no dog in this fight, beyond this: stop giving out your important info, then it can't be stored or "lost" for whatever reason. Just say no to store clerks or utility clerks "demanding" your SSN. If you freely give away your data without putting up a squawk, don't be surprised if it isn't "your" data any more, because you just gave it away. As to computer security, there isn't any, people should just recognize that. At *best* there are some attempts at computer security. In the US, the only legal entities that can demand your SSN are state and federal authorities for various reasons, tax, getting a drivers license or professional license, etc., and they must state a reason, banks and brokerages, and employers AFTER you have been hired. Anyone else can ask for it, but you aren't required to give it out. They can possibly refuse you the service then, but that's a crapshoot. Usually when I get asked outside of the legal requirements I retort and demand to see their customer indemnification policy in writing if they suffer a data breach and my data gets compromised. That shuts them up, because they don't have one, at least I have never run into one with any utility or service or store. Just keep going upstream over the clerks or first manager's head, keep asking to see the same written guarantee that you will get paid something if they suffer a loss. They've always caved for me at that point, I get the service.
Right now, the law is pretty unclear what happens if a company you give your information to, loses it.
But what about other crimes? If a company is caught in some scheme by say an employee, it has insurance. Those with good security practices have lower premiums.
Let's just clarify the law, and let the cost of those security measures be borne by those who require keeping the information.
Not only should there be criminal damages, but attempting to keep the thieft secret should carry an even heavier penalty.
And the famous part of the Fifth Amendment hits that head on:
"... nor shall [any person] be compelled in any criminal case to be a witness against himself, ..."
So it's not going to happen in the US. Give it up.
= = = =
The people harmed are easily identified. It makes more sense for this to be a civil matter, with heavy financial penalties being paid by the company to the victims of the identity theft, rather than into government coffers.
If the government were to legislate or rule-make the penalties and/or automate the process in corporate regulations, rather than waiting for class action suits to lay the ground rules (and line the pockets of the litigating class while the victims get pennies), so much the better. (Assuming the legislators don't just write a slap-on-the-wrist preemption law for their corporate sponsors. B-( )
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
CEO, CFO, CTO, doesn't matter to me... but if a company officer is not responsible, the underlings can whine about not being able to implement best practices due to (budget, boogeyman, idiot cousin got the job, whatever you need, pick one) then it's not going to be taken seriously.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Tune in next week for more foregone conclusions brought to you by Slashdot. Slashdot: If the answer isn't obvious, we don't post it! Airs Mondays 9et/7ct/6pc. Check local listings.
Such corporate "responsibility" will only open up another sector in this insurance industry (for indemnification against such law suits) and destroy cottage industry.... the issue of data security goes much deeper than simpler suing people (such a typical americanised solution).
This other point is that there is mention to "giving the data away" which is not the point of the cited news article involving best western in which the data was _stolen_ through negligence.
I guess a good analogy is that if I leave my car with a garage and it gets repaired should I sue them for the loss. The difference here is that so many more people can be affected by the same situation when the internet is involved.
I do believe however that much of the blame needs to be placed at the company level. Many times the risks are known ahead of time by both IT and the business, but the business has decided not to spend the money to fix the problem and have signed off on the risk. Sometimes there is nothing further the IT department can do without the express permission of business. In fact, this is fairly frequent.
And the remedy for that is to make collecting the data and leaking it through substandard care in its handling a very costly thing for the company. Then the risk/reward ratio for protecting it will tend to sway upper management - and give the IT department a strong argument for the necessary budget to accomplish the work.
Criminal penalties are the wrong way to create this incentive structure. Big-bucks civil penalties (payable to the people whose information is leaked), however, look like something that could do the job - and make a start on compensating the actual victims for the harm done to them.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
There's an old saying: "A lie can make it halfway 'round the world before the truth can get its shoes tied." The 8 million (one year) figure will become carved in stone, and anyone who says otherwise will be "an apologist" for Best Western.
FWIW, I stayed at a Best Western a month ago. The Bride of Monster booked our room with her credit card, so this is not a purely academic matter for me. We've already contacted our bank and suggested they find out exactly what the exposure is.
[100% ISO 646 Compliant]
SVM, ERGO MONSTRO.
Attempting to legally define responsibility for "reasonable" security is a tricky one. You don't want a situation where corporate can, say, consistently shirk on security implementation, then hang the poor bastard who had to make the best of a bad job out to dry when the time comes(not that that would ever happen, no, definitely not, never). On the other hand, having a checklist of "OMG Industry Best Practice!!!1!~) ass-covering steps is pretty much writing the script for security theatre.
I suspect that going after the type, quantity, and duration of data storage is a much more productive avenue. For any given commercial relationship, certain data storage will be necessary, for a certain amount of time. Not much we can do about that. Anything beyond that level, though, should be open to stiff liability in the event of a breach. You want the advantage of storing extra data? You take the risks, like it or shove off. The trouble(particularly bad in the US, though hardly good elsewhere) is that there is essentially nothing, other than the low and falling costs of storage, counterbalancing the desire to hoard as much customer(no, I'm not going to say "consumer") data as possible. Make anybody who stores more than the necessary minimum of data liable for damage caused by breach or inaccuracy and the problem should be considerably reduced.
Even if the above seems, shall we say, unrealistic, there are some basic steps we should have taken ages ago. FFS, companies that have data stolen aren't even obligated to warn people in some jurisdictions!(See the ChoicePoint debacle a while back, they warned California customers, because the evil commie nanny state had the crazy idea that people ought to be warned when somebody fucks up and gives their data to criminals; but everybody else just had to puzzle it out) That is absolutely insane.
Leaked data, by itself, isn't a crime in this regard. No harm comes to anyone until someone with criminal intent actually does something to it.
Harm comes even before the data is misused (or if this never occurs) because the people whose data was leaked now must take extra effort to protect and monitor their financial and other records. This has costs in both money and time that could be spent on more enjoyable pursuits. The added stress is also damaging, both to enjoyment of life and to physical health.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
It's the responsibility of the people who created this system that people cannot reasonably opt out of.
With "drug laws" as they are, there are limits to the amount of cash anyone can carry without it potentially being seized by cops. You can't pay for everything in gold can you? With the majority of banks out there simply refusing to do business with you for not having a social security number, it is essentially impossible for people to exist in society without allowing your identity to be entered into various systems and databases. The credit and banking system has created this potential for abuse of our identities and it is the credit and banking system that should be held accountable for the abuse of the system that we are all but involuntarily required to be a participant in.
Furthermore, since so many businesses feel it is in in their interests to collect our information and put it at risk, they should also maintain responsibility for its abuse when it leaves their control. Once again, as a condition for doing business and ultimately for leading a "normal" mainstream life, we are essentially powerless to opt out and are otherwise defenseless and unable to protect ourselves from what may happen when mismanagement and abuse of our trust occurs.
What a great system they have where they reap all the benefits and we burden all the risk? I think it's more appropriate that they bear the risk along with the benefit. If they want to have the benefit of collecting private information, they should bear the consequences when the information is abused as a result of their own abuse or negligence.
Part of the issue is storing identifying information, the other issue is storing credit card info. There should be no excuse for storing credit card info.
I was at Home Depot (Canada), returning something I bought earlier, and I reached for my wallet to give the guy the credit card to refund the item. He said, "Oh, we don't need that Sir, it is all stored in our system". I said: "You store credit card data on your computer"? He says: "Oh, we don't have access to it".
The point is, not the employees having access to it, but the data getting copied or stolen by criminals, such as the Best Western case.
Some credit card gateways provide a token based approach to recurring charges, such as monthly subscriptions, but it is not a standard that can be used everywhere with any card, and any merchant.
2bits.com, Inc: Drupal, WordPress, and LAMP performance tuning.
In Texas (and in other states, it seems), it is against the law to leave your keys in the ignition. I haven't yet figured out exactly what the purpose is for that law, ...
It reduces car theft, thus reducing the load on law enforcement and insurance rates. It also makes it harder to steal getaway cars and increases the likelihood of catching the perps before they do something like rob a bank, reducing that victimization.
Or at least that's the sort of theory I'd expect to be behind the rule.
(At least one rural western state has had a requirement that any gun carried in a car must be loaded - so it can be used by the driver to defend against its own theft. They'd had a lot of trouble with walkaways from prison jacking good samaritans who rescued them in the desert.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
The thing is, the corporations are deemed too valuable to be punished. THIS is what should change.
Seriously, what the hell? Consider the HSWA (1974), the Environmental Protection Act (1990) and the Data Protection Act (1998), all of which carry the possibility of fines and a jail term if breached?
All intents and purposes. Not intensive purposes.
While we're at it, why let the manufacturers of buggy commercial software off the hook?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
It's mainly so that insurance companies don't have to pay, if someone steals your car when you leave the keys in them.
He who said 1,000,000 monkeys on 1,000,000 typewriters would eventually type the great novel, never saw an AOL chat room
Next question please?
Companies will only stop allowing mass identity theft if there are definite consequences for their failures.
The real question is, who in the company do you punish? Responsibility could lie with management, IT personnel, the end user, or any combination thereof, and once the cat is out of the bag, they will all point the finger at each other (and management will happily fire IT personnel or the end user to deflect blame). How do you determine who to drop the hammer on?
I'll tell you what... Before you make a decision on whether companies should be responsible for theft of their information, make the police responsible for murders that occur on their watch.
No really, I'm not kidding. What surprises many people is that the motto, "To Protect and Serve" is just that, a motto. Police have NO duty to stop a crime in progress, only to execute the law by arresting those who have committed the crime whenever its convenient. A good example is someone who is either in witness protection or perhaps has a patrol car stationed at their house if they are a testifying witness. Despite the assurance that you are "protected" they can't be sue or held liable for failing to do so.
It seems silly to hold a corporate entity to a higher standard than our own police forces. Sure, hold them liable for pure negligence, like creating a webpage that lists their customers' name, ssn and cc numbers, but for pure theft no way.
When I was doing standards work, I was introduced to the notion that only "must" and "shall" (i.e., imperative words) mean something you have to do. Words like "should" are really synonymous with "don't really have to at all" in standards lingo. They just mean you have to answer for something in words when someone calls you on it, but ultimately that no one can force you.
So too the real difference between civil and criminal is that civil means you can buy your way out pf doing the wrong thing and criminal means you really have to do the right thing. So people can choose.
Asking whether civil or criminal law applies isn't the thing to do. The thing to do is to ask whether this is really something that has to be done or whether it's ok to just let people do the wrong thing and then occasionally pay a fine. If you don't mind having your identity stolen and you think maybe courts will operate efficiently in your favor to reimburse you with extra dollars to spare for your trouble whenever it happens, you definitely want the civil penalty approach. Or if you have a magic way to have the problem not happen to you and you just don't care that it happens to someone else who is in the unfortunate set that you have excluded you from. But otherwise, I see no option other than to say criminal.
That doesn't mean I think criminal law should be retroactively applied. It just means I think business people take very seriously the criminal law, and that if this is on that level of magnitude, then that'st he approach. But I'd decide first just the question of whether this is a "should" or a "must". The rest will just follow from that. Present attitudes in business tells you businesses think it's a "should" (meaning "don't really have to at all"). The question is, does the public agree? For the public to establish "civil penalties only" is, I suspect, the same as saying the public agrees it's a "should"--a mere cost to be managed, often after-the-fact.
Kent M Pitman
Philosopher, Technologist, Writer
Agreed, but... well, did they? Invariably every single of these cases I hear about, involves some variant of
- idiot marketer or salesman is given a copy of the whole fucking customer database on a laptop, he loses the laptop
- idiot boss gives some contractor a copy of the customer database (or recently in the UK, the prison population database) on an USB stick, he loses it
- idiot puts a copy of the whole customer database on an unsecured web server so he can download it from home, thinks that it being in a "secret" directory is actually security (especially in the dot-com days this was the #1 failure mode, but it's not entirely dead yet)
- the infamous AOL failure mode, "OMG, Google is eating our lunch, someone plz code a Google killer. Here's our customers' search strings as RL data to work with."
Etc.
I'm sorry, but that does _not_ qualify as taking the necessary steps. Not even as trying.
What I see is some idiots trying to circumvent security for the sake of a few extra bucks ('cause that salesman might impress a customer with a sharply drawn chart) or to save a few bucks in costs (e.g., so they don't have to get an extra desk for that contractor.) It's plain old greed.
And I still think that we see a variant of the old, "bad money pushes good money off the market". Only this time with companies. The pricks which save a few bucks or earn an extra few bucks by being cavalier with your data, get to undercut and push those off the market who do the right thing. Until we slap some penalties on them that actually reverse that situation, it _will_ keep happening.
A polar bear is a cartesian bear after a coordinate transform.
Seriously, having worked in IT Security for some time and done numerous "compliance" projects. Compliance takes time and costs money. Too many times I have been told "we just don't have the money for that this year." Corporations commonly engage in the 'risk' game where they risk it for as long as they can. Until the bank stops taking their credit cards (in the case of PCI Compliance) or there is an actual public breach - the risk is quite low. I'm not against criminal charges but they should be levied on a corporate officer and not the rank and file IT person. This person has zero responsibility for the financial decisions required to keep data safe. I make recommendations until I am blue in the face but until management realizes the risk to them - they won't touch it with someone else's ten foot pole.
Wouldn't this lead to all companies needing to purchase a data loss insurance policy, much like doctors need malpractice insurance? The end result would be richer lawyers and insurance companies, more wasted time in court, and companies not needing to change because they have insurance.
I do think these companies need to be held responsible, but I think that they are already afraid of the PR hit from losing data, and their IT managers should already be afraid for their jobs if a data breach occurs. I really doubt that this sort of law is going to help.
i`ve had my personal data lost for me by my ISP twice! and nothing happened to the companies. my partner had her info collected by Best Western, and was on the discs lost by HMRC.
no one should get away with anything like this - and companies should be fined heavily. there is no need for a lot of these details to be moved around or even stored - my partners details merely used to sign in incase we damaged anything, the room being paid for by a local authority.
it would be a tough thing to try and punish a company for, but if you remember the little people getting shafted who may not have had much to begin with - it's a crime plain and simple.
Criminal blame won't make a difference unless it automatically applies at the top corporate level. Otherwise, lower-level grunts will be served up as sacrificial lambs. The only method that can be used to justify to management having appropriate security expenditure is to attach a solid price tag to bad security practices to offset the price tag of good practices. That means large and immediate monetary penalties for loss of information (indexed for inflation of course). That way management won't decide to risk fighting any class-action lawsuits for 10 years until they can retire, leaving their successors to deal with the mess. If you can lay out to management "You have 100,000 accounts, and a security breach is going to cost you $X and your current practices have a high chance of a security breach in the next few years", it's a lot more concrete than if I talk about the historic average cost of security breaches in unrelated industries (based on contacting stakeholders, PR, etc., after a breach). Put a solid price tag on it and companies will either adjust, or go under faster and prevent further loss of client information due to continued poor practices.
Laissez lire, et laissez danser; ces deux amusements ne feront jamais de mal au monde. - Voltaire
"IT negligence" as suggested by the summary is caused by Management's "head in the sand" tactics.
There've been a number of times over the years where I've raised security issues about an existing system, or even a proposed system, and been beat down by Management because it would cost too much or take too long to fix it. They prefer to not "spend money frivolously" and instead gamble that the problem will never be exploited.
I'm sure this is a common issue throughout the industry... fine Management or send them to jail if IT can show an e-mail or other evidence where Management have refused to act on something.
Well, according to the FBI, this includes all forms of credit card fraud. This is mostly why "identity theft" is getting so much attention and seems to be growing by leaps and bounds.
I have been subjected to credit card fraud many times, as have many people I have known. I have yet to meet anyone that has experenced any loss, even the supposed $50 that you might be liable for. Zero loss, get a new card and move on. Sometimes a minor hassle.
The sort of "identity theft" that most people associate with the term is where someone obtains credit under false pretenses. I don't know what the actual incidence of this is and because of the FBI combining it with credit card fraud, we will probably never know the true impact of this. What I want to know is how often this is really happening and has anyone, ever, been a victim of something beyond credit card fraud because of one of these disclosures.
I don't see any point to trying to make a bigger deal out of it if there have in fact been zero occurrences where this information has been used to someone's detriment.
How about it's illegal for a company to put that sort of data onto a laptop?
Why do many of these people even need laptops? They work in a cubicle/office sitting down. They then go home and work at a desk sitting down. Set up two RDesktop terminals: one on the corporate LAN, and one that VPNs in.
You get exact same work environment and your data is safe on the server, with everything being encrypted with AES.
Data is compromised only when the person's account information is stolen (stealing the dumb terminal doesn't even help you).
For some people this won't work because of the ego trip involved in getting a laptop (and some people do actually need laptops), but others will appreciate the fact that they don't have to lug this thing around.
And if you can standardize on a particular model of unit you can perhaps throw in smart card logins.
If a company permits a breach of a customer's personal info, each individual customer should be entitled to sue the living snot out of the lax company.
Should be brought up on negligence charges if they fail to implement proper security systems, ecnrypted backups, or basic info "storage" standards.
Trying to install linux on my microwave, but keep getting a kernel panic...
In the Netherlands there are about 90E6 unique social security numbers, which contain no information whatsoever (no birthdate, etc.). Its population is 16E6 people. Therefore in theory, based on a life expectancy of 80 years, you would expect a reissuing cycle of 450 years. Although in practice, I figure they will add a digit when the numbers get in short supply. I base this on that there used to be numbers of 8 digits (but that was before a change of system) and I've seen mention of 10 digit numbers in some documents. Of course, that would violate the principle that the number shouldn't contain information, because the number of digits would be a (very bad) estimator for your age, but a lot of records tied to your social security number are kept after your death, so I don't think they'll have a choice. Anyway, the Netherlands are only doing this for 20 years now, so they shouldn't be in a hurry.
Oh for fuck's sake. If you're going to blame anyone, how about blaming the people resposible?
Some jackass shows up at a bank, gives my name and social security number, gets a loan, and then the bank harasses me for their money. Sounds like the bank is the one to blame. They're the dumbasses who didn't adequately determine who they were dealing with, and they're the ones who sought to ruin me financially by trying to collect money I didn't owe them.
The problem isn't that companies are leaking my social security number, the problem is that I can't tell everyone my social security number because a lot of dumbass companies assume it to be a PIN number and will make my life hell if anyone else happens to know it.
SSN's are horrible primary keys since they REPEAT!!!
Citation needed. Badly. I've occasionally read about SSNs, and every document says that they are never reused. Occasionally, it will happen that two people with similar birthdays will be assigned the same SSN, but that is an uncommon mistake that SS attempts to fix, by assigning one or each of those people a new SSN.
Sarbanes-Oxley has already wreaked havoc on the business world.
Have the costs of having to do better accounting and do better data warehousing really been crippling and/or provided no other return beyond compliance?
Extending culpability for data breaches to criminal prosecution would be even more destructive in terms of the changes and security costs involved in protecting the company from financial damages in the event of a data breach.
Exactly. This is 100% intentional, but it's not because the people who've conceived it are anti-business communists, it's because they realize that markets aren't magical elves. In this case, markets aren't really seeing the cost of data security -- or rather, the costs of poor data security practices are externalized from businesses who don't engage in it across their customer bases. Legally recognizing an obligation to protect customer data and connecting it with a cost structure means the market can start to value it.
I really don't see anything wrong with this.... except one big honkin' problem: most business entities are going to have as hard a time as your average consumer determining whether or not they've got good security. It takes a data security expert to know a data security expert. Businesses with no genuine security seed talent will be pretty much flying blind with regard to their liability until something bad happens to show them they've got a problem.
Tweet, tweet.
..I see no option other than to say criminal.I see no option other than to say criminal...
So now you want to increase the prison population by another quantum jump? The US already has one of the highest prison populations per capita of any nation on earth. Why is this? Is it that Americans are basically more evil than others? Is it that our society has criminalized many actions that others do not? How many people are sitting behind bars today, because they were merely in possession of a substance or an object? People should be held accountable for what bad things they DO, not what they have.
In order to commit identity fraud, it takes two actors. One of them is the fraudster who impersonate someone else. The other actor is a financial institution or merchant who does not diligently check whether the information given is truly connected to the person giving that information. This second actor should be held responsible to bear the entire cost of the fraud. If that were the case, these people would make sure that the person they are giving money to or rendering a service for is really, for sure 100%, legitimate. With such a system, these institutions would have a strong incentive to carefully balance the costs of such security checking with the costs of possible fraud.
As it is now, the person legitimately connected to the information that the fraudster supplied is usually left holding the bag and taking the loss. Careful check of the information at the point where fraud might occur, would be much more effective, then a Herculean effort to protect every bit of information.
Just as in the physical world, we make the receiver of stolen goods a partner in crime, so also we could in the informational world. At the very least, even if not accused of a crime, someone who obtains stolen property may have to give it up to the rightful owner.
In the same way, a financial institution or anyone else who gives away money or services on the basis of stolen information should at least bear the loss.
All theory is gray
A new law is needed that forces companies to disclose (to the affected customers at a minimum) any time that data breaches have occurred. This then allows people to e.g. check their credit card statements more carefully in case their CC# has been used by whoever hacked the database or whatever.
Heh. You ask the question and then you lead the answer a certain direction that seems to suit you. Let me suggest another that perhaps either didn't occur to you or doesn't suit you as well:
The reason we have a high prison population is that we have two classes: the imprisonable and the rich. And the criminal laws are made by the rich, not the imprisonable, to apply to what I'm sure they view as the lesser classes ... If the people making the laws are confident they won't be
affected by the laws (not because they don't plan to violate them, but because they plan to buy
their way out if they do), then they don't mind making stupid laws that overfill the prisons.
I don't do drugs. Never even tried 'em. Never would advise anyone to. But I'm still no fan of the war on drugs. It seems a foolish way to drive up the price of drugs, feeding money to the underworld, making addicts need to rob more money than they'd have to otherwise just to feed a habit, robbing the government of legitimate tax revenue, and, yes, overfilling prisons. So if you're looking for space in the prisons, I'd swap some of the marijuana users right out of there and happily fill the prisons with someone from the elite class who was warned to safeguard someone's data but didn't. (Note: Not retroactively applying new laws. Post the new rules. Give people time to convert over. But then hold them to doing the right thing going forward.)
The crime of failing to safeguard someone else's identity can have dire consequences that go beyond those affected...
What if I were on my way to visit a sick relative when I fell victim to identity theft? What if by the time my credit cards got unlocked, the relative was dead? How am I reimbursed for losing that time together? What if the relative died because I didn't reach them?
What if I were trying to make it big in business and needed the money then. What if by the time I got the money, my business opportunity was lost?
How does one really reimburse these things? What kind of attitude is it to say that as long as it gets paid back later, it's ok?
All making a company pay can do is ultimately recover money, and usually not all of it. Lawyers fees get lost along the way. And lots of time is lost that is not billable, going to visit lawyers and courts, fretting generally, etc. Some people can't be bothered to pursue things. Some don't know how. Some are intimidated out of their share. It is simply not the same.
The problem with the world today is that certain people don't fear things any more. They've studied the system and figured out how they can work it. And so they are without shame in how they exploit it. Restoring a bit of healthy fear for actions that really should never happen is not a bad thing. That doesn't mean that the government doesn't menace people for the wrong reasons. It means that you have to make sure the rules are the right ones. I feel more comfortable saying that businesses should safeguard data on pain of criminal penalty than I feel telling someone they can't smoke marijuana on pain of criminal penalty though.
Kent M Pitman
Philosopher, Technologist, Writer
There should be a stiff fine for the company. An incentive to think hard about security. Blaming IT is not good. Its actually wrong. Is IT responsible for decision making in IT? RARELY! Management usually insists on decision making, and very often make really really poor decisions. They then make IT suffer from their bad decisions: "We picked it, you fix it!" Management at TJ Maxx picked the security method. A management lacky was in charge of security. He didn't know any better, wasn't qualified, but was the boss anyway. Blaming an IT staffer for his bungling and incompetence doesn't prevent problems (stupidity will continue, because the stupid will go unpunished). The company must be fined. Heavily. It will at least make the incompetent think twice before failing to listen to advice.
That makes NO sense! I know that theoretically it's the company's responsibility to secure the data, but if some 1337z h4x04z figure out some crazy way into the system, then why should the company's top people face criminal charges? If you don't want to risk your information getting stolen, then don't give it to anyone. The company is also a victim in this case. Charging the victim is like this: You have bars on your windows and locks on your door. One night, a burglar busts in someone and jacks your PS3. You get charged with a crime. Does that make sense? No. And neither does this.
McCain/Palin '08. Now THAT's hope and change!
If you try to jail the CEO, he will say it's the CTO's job to secure the systems. He in turn blames the head-of-IT-ops, who in turn blames the lonely sysop. So who's going to jail? All of them? The top? The bottom?
If YOU do something bad, YOU have to pay the price. We've got several gradations here: pay a fine, go to jail, both in different amounts.
If a company does something bad, what can we do to make it pay? Well, exactly that: Make it pay.
Now, if YOU know that a fine for XYZ is $1, and it's easier for you to do XYZ than something else, then you'll easily do XYZ. Besides that the chances of getting caught are usually small, the fine is such that you can easily pay up. If you have to pay $10000 as the fine most of us will think twice, and be really careful.
In the case of a big company, $10000 is nothing. So fines you put on companies should be proportional to their size. Faking profits or losses is easy. So it should be proportional to their turnover.
Here in Europe, MicroSoft got fined EUR 1 billion for ignoring antitrust laws. This is an amount that even a company like MicroSoft feels.
With several situations, legally someone is responsible. But after they have "paid" in whatever way that is, they might then be able to hold someone else responsible. For example, if I buy a stereo here in The Netherlands, I've got warranty service from the shop. They can claim: "factory warranty: 1 year" all they want, but the law gives me the right to ask the shop to fix problems in the product during a "reasonable time" no matter what they claim. (i.e. warranty: 1 week will not work either!).
So, if a company pays a fine, and finds that this evidently the fault of a certain employee, they can sue that employee afterwards.
The problem of scale then kicks in. If the company pays a $1M fine, but this is evidently the fault of precisely one employee. (Say he was told not to do X, but he did so anyway, finding clever ways to escape the regular checks of the company to see if he was complying with the order) Then how can that single employee pay the $1M "damages" to the company?
This strikes me as one of the few times when it makes sense for the customer to sue the crap out of the company that lost the data. Sue for every penny you can get so that companies start to take notice of this and do their due diligence to protect that data. I'm surprised no lawyer has gone class action with one of these lost data incidents.
For years now I have largely refused to sign on digital signature pads because they tell me *absolutely* *NOTHING* about what happens to my signature. I suspect in most cases it's sitting on an unsecured, unencrypted server with my CC# and other transation info. My CC# and signature are enough for an enterprising hacker to create a card and have a LOT of fun at my expense (partially my expense, anyway). A physical signature (as opposed to digital) has physical security around it (safe, locked store, etc.). I can't assume any security with a digitally captured signature, UNLESS THEY TELL ME WHAT THAT SECURITY IS.
If you begin to hold these companies accountable then do you also have to hold the people that made the software with the holes in it accountable? Slippery slope indeed. I think the best thing is to hold the criminals accountable.
It is fun to think about corporate types getting reamed over stuff like this, but as many have already pointed out, the little guy is always the one who gets the shaft.
How about stiff fines for companies that do not disclose breaches within a short period of time? Possibly 48 or 72 hours, to give the I.T. staff time to properly evaluate the situation?
You know that if some sort of criminal charges came from a security breach, it wouldn't be CEOs and CIOs going down. It would be us.
This seems like a pot-of-gold waiting to happen for lawyers. Its blantant, harmful negligence by some well-off companies. And customers are suffering for identity theft or fear of it.
How on EARTH do these corporate jackasses get away with this stuff, is beyond me.
They send crap mail to my mail box and my neighbors and their thug kids rifle through it and take my mail, sell it to whomever will give them a few bucks so they can buy more dope and you see the problem.
The ONLY people, these days, that are paying for the crime are the innocent victims. The mere fact that I have a credit card with some bank and do business with it does not give anyone the right to sell, loan, borrow, use - whatever - MY INFORMATION. This data should be destroyed immediately after the transaction ages to a certain point.
At no time should I have to purchase "LifeLock" bullshit. I shouldnt have to pay for that crap. Best Western, in this case, should have to pay damages to each person on the list.
When the corporate CEO do-nothings begin to realize that they'll have to open their precious wallets and pay money for their mistakes, then and only then will you begin to see a reduction in ID theft.
Comment removed based on user account deletion
Comment removed based on user account deletion
Nothing to see here, move along.