Slashdot Mirror
Long-Term Liability For One-Time Security Breaches?
An anonymous reader writes "Not a month goes by where we don't hear about a theft of some organization's laptop containing sensitive personal information, not to mention the even more frequent — but often kept secret — breaches into company networks and databases. It is definitely true that you should be responsible for the security of your information when you handle it, but what happens when the theft of your information is not your fault? You have handed over this information to a company or organization and trusted them to keep is secure, but they failed. They might notify you of the breach or theft, and they might even set up a credit monitoring service for you for a year or two, but the problem is that this information may be used years from now. Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?"
Well you could always change all the numbers and important information that you can. After that I recommend praying to your favorite diet(y|ies). That or keeping all of your money in a shoebox under your bed.
But we give it too much power to allow that. A much more fundamental change is needed. Until then, long term liability is probably the only alternative. It should never cost the victim anything at all. All costs should be laid on the leaker. And "Trust no one" with your info still applies.
For justice, we must go to Don Corleone
Not to sound condescending, but when you hand your stuff over to a third party generally there is a contract signed between you and them, what you are looking for *should* be in that contract.
crazy dynamite monkey
No. Who told you life was fair?
You're responsible for protecting yourself. Don't expose your data unless you need to; then change it if you can. Don't put your money where it can be stolen. Etc. (Wo)Man up. The world is not here to wrap you in cotton balls.
I've fallen off your lawn, and I can't get up.
Ironically, the four UK Credit Reference Agencies have announced today that you can do a web based credit check on youself for the sum of £2.00. PReviously only one of them allowed web one time (ie non annual contract) checks.
If they make it quick and also cheap then maybe more people will take responsibilty for checking their own details on a regular basis.
Posting anon for obvious reasons....
the real reason we hear more about it and hear of more of them every day is because they are the media topic of the moment, just like when northern rock was in trouble, suddenly, all the banks where in trouble and everyone took their money and caused the financial meltdown.
in short, this sort of thing isnt happening more frequently than it previously was, its just being reported on more
portfolio
The first oddity is why the author believes that the data would sit around for years before being used. Like there's an "exploit bank" where you can deposit your collection of stolen data and gain interest on it until you "cash them in". I'd think far more likely it'll get used fairly rapidly, or never. How you fence or launder millions of records is kind of a mystery to begin with.
The second oddity is we are mostly dealing with the bottom percentiles of personnel, equipment, hardware, software, and design. So the article blissfully dreams "Let's hope that these reasonable measures will include the use of encryption." But you know that fools are just going to add another column to the database called "encryption key" so as to decode the other columns. Or store the key in C:\key.txt. Or go all ROT-13 or whatever the unicode version is of ROT-13. If you're dealing with screwups, adding more conditions just makes their screwups more rube goldberg and hilarious, it doesn't prevent them from screwing up.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Anyone asking if something is "fair" is clearly too young to realize nothing in life is fair :-) ... "fair" - LMAO. The point is not even worth considering
The extent to which liability should be assumed on the part of the company responsible for the data breech is an appropriate question, but
The more financial liability we push off to those who make the mistakes, the more we will pay in the costs of goods and services and/or the more companies will play organizational games like incorporating overseas or contracting out data-gathering to "independent third parties" who can simply file liquidation bankruptcy in the event of a too-expensive data breach.
Or, when that is not possible, goods and services may not be offered at all because no company will sell them at a price that the public will pay after factoring in liability costs.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Your security should be more costly to bypass than what the security is protecting. If you can't do this, you're making a business proposition to the world: "Hey, free profit at my expense. Inquire Within." If you don't want to pay to protect it properly, then the best you can hope for is that someone else's stuff is more shiny than yours.
#fuckbeta #iamslashdot #dicemustdie
Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?
you're demanding fair credit? what gives you the right? you don't have any credit. if you want credit, there are terms. if you don't like the terms, you don't get credit. this has nothing to do with "fair".
Well, if someone uses your personal info to get a big loan in your name that you then have to pay back, it can be a bit of a problem. Sorry if understanding simple things like this is too difficult for you.
Wollt ihr den totalen Krieg?
You have handed over this information to a company or organization and trusted them to keep is secure, but they failed.
This *is* your fault. The moment you entrust your data to someone else, you are at their mercy--regardless of contracts, guarantees, and their best intentions. Mistakes are made, people are human.
The 3 elements of the tort of negligence
1) did the respondent owe the complainant a duty of care?
2) did the respondent breach that duty
3) did that breach cause the complainant harm?
That all of the really useful data tends to have infinite life (birthdate, SSN or equiv for non-US, place of birth) compounds the problem (the "use case" that comes to mind is some aged drive surfaces in the used parts market and some scofflaw procures it and uses it long after the breach itself).
Obviously, each organization should have their own ID numbers, and any given "customer" ID should be able to be associated with various time varying external credentials and really good stuff which isn't time varying shouldn't be in the hands of third parties.
Regulators (e.g. SOX, HIPPA, UK data protection act(s)) all seem to miss the boat about limiting the scope of breeches. Legislating that no breech ever occur is laudable, but impractical. So minimizing the harm done should be the focus.
More a matter of when, not if, should a large government agency loses a massive amount of business records.
Their main protection is government systems are "self-encrypting", that is written mostly in pre-1980 OS-360 COBOL.
> Is it fair that you have to worry for decades and pay for further credit
> monitoring when they are to blame for your information ending up in the
> wrong hands?
You are liable for the actions of your agents. If they screwed up you can sue them but you are still responsible to your customers.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I'm 99.44% sure that my check card info was compromised in a data theft incident but I have no proof. One day, I got a call from my bank saying that my current check card was susceptible to fraud and that a new card had been sent to my mailing address. Please call if you have not received this card.
That set off a couple WTF questions in my head. First of all, it was implied that my replacement card should have arrived which means they'd sent it at least 2-3 days earlier. If fraudulent activity had been detected, they should have notified me immediately and blocked the Visa number. But I'd used the card the day before and that call was the first I heard about fraud.
I took a closer look at my account activity for the previous few months and every payment and credit was legit. I called my bank and spent almost an hour talking to several different people to get an explanation. The best I got was, "Well, they want to upgrade the gold check card holders to platinum." I asked if there would be a new Visa number and expiration date on the card because I had to update some autopayments if that was changing. "Nope. The number won't change." If that was the case, why couldn't they just wait another 6 months until my gold card expired? And why follow up the early mailing with a phone call talking about fraud?
So I went home and checked the mail. There was my new platinum check card with a new Visa number and expiration date. Why the new number? I'd had the old one for 12 years and it was burned into my brain.
So all I can figure is the details of my old card were lost in a security breach but hadn't been used yet. Why else would I get bumped to a new card 6 months early and a new Visa account number for the first time in over a decade? I'm sure if I pressed hard enough, I could get an answer but their first and second tier people are doing a good Sargent Schultz imitation and I'd wasted enough time on it.
But I shouldn't have to dig and probe. I should have received a letter with my new card explaining EXACTLY why the new card and account were necessary. The name of the processor that lost the data, the date/time the data was compromised, and the action taken against the company that lost the data.
TFA is the summary segued into mentioning the Data Accountability and Trust Act is before the Sentate. Here is the tracking site for that act, and the important Summary:
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221&tab=summary
It's fairly straightforward. It defines terms and requires the information holders to follow a structured method of protection and reporting. Places oversight with the FTC. Notably "Prohibits the FTC ... from requiring the deployment or use of any specific products or technologies." Does not mention encryption.
But also note this is hardly the first time such a bill has been presented.
http://www.govtrack.us/congress/bill.xpd?bill=h111-2221&tab=related
Nor is there mention of what bizarre shotgun-marriage legislation this bill is combined with, or indicates what kind of support there currently is for this bill.
I don't know... I'm horribly cynical about this sort of thing. But one good result might be that legislated and audited & enforced care of personal information (simple as name + credit card number) might finally make sites and services not just a little more careful with databases, but start to question whether they should have them at all. Right now, there's nearly no costs or responsibility overhead for collecting everything you can about your customers, and passers by. This bill makes it costly; that'll limit businesses to acquiring (and holding) only the information they need to conduct business.
Still, I'd like to see specific time limits on holding things like credit card number after a transaction, and very specific limit on sharing that information with "partners" etc. Also I'd like to see my "conduct business" above limited to processing the original transaction with you; that the personal information acquired cannot be used to make money in any other way whatsoever.
(Sorry for doing your job, Soulskill, by supplying those links. Perhaps you could add the car analogy?)
I feel that the information I share is at my own peril. Perhaps we should worry less about data security and invest more energy in learning how to get stuff done without the need to share important info in the first place.
The NASD has been known to levy multimillion dollar fines and pull dealer licenses for offenses made by previous staff. Their reasoning is that any competent professional would see and correct pre-existing issues. To be fair, they gave me and my staff 6 months to fix some stuff related to email auditing and retention and even made suggestions...
[RIAA] says its concern is artists. That's true, in just the sense that a cattle rancher is concerned about its cattle.
This is probably about identity theft and getting e.g. loans by simply knowing the "magic" numbers of someone else's life.
...) to let them check if you are really the person you claim to be? Makes it a lot more difficult to get these things, and shifts liability back to the banks (if you can show you never went there to prove your identity, they screwed up by giving that loan - their fault).
Why is it still possible to get these things in the US without going into e.g. a bank and showing them a valid photo ID (passport, driver license,
If you've got a problem with a bank seeing you in person (why?), maybe a new institution could be founded that does only that: Check IDs of people for others. Like this:
1. Request a loan
2. Get a unique magic number of your bank that doesn't carry any information but the bank knows it belongs to you and that loan
3. go to the ID-check-service and let them sign that number, e.g. with: "Person xyz has proven his identity" (if paperwork, or better get a digital signature)
4. Give signed number back to the bank
Bank knows you are you, without you ever going there in person and the ID-check-service doesn't know what you needed that signature for (they just got a "random" number and signed it for a fee).
Expand this scheme for other services (governmental, etc.) and you get all the privacy you got now with a whole bunch of more security.
We ditched Google for Faculty and Staff at our university and this was one of the reasons why. Too much information given to a third party and no true liability if some of it were lost or stolen. If you're working on potentially patentable research, and you send it through Google's servers, and some "glitch" lets someone else look at your email...well, you might have lost a patent. And Google doesn't pay. And Google could argue that, well, what do you want for free? At which point, we say, "Nothing, thanks. We'll move our services in-house." Which is what we're doing.
Truthfully, important documents don't belong on email. You can link to a password-protected SSL site from an email (like the certified email at the US Post Office) but attaching critical documents is just not a good idea.
This is a ridiculous game we keep playing over and over again. We have "secret information" we entrust to every business entity with which we do transactions. They aren't quite as secret any longer. And these other entities have people in them... not all of them can be trusted and you will never know who or how many whos have had access to the information. It's a very flawed system especially in light of modern communications technologies available today.
We need a system in which credentials for transactions are good for one-time-only. I present my credit/debit card and this information doesn't change again until either the expiration date arrives or I have it changed. But if I do something with my account "device" that issues a payment ticket number (rather like a cheque in many respects) that is then presented to the business entity to be used only by that business entity and only works once, twice or however often it can be used as approved by you. That code would only be useful for the other side of the transaction because of their encryption key token must work with the ticket number I issued. Then these stupid open secrets won't need to be a concern any longer.
The big problem isn't that people can or can't securely store this information because we already know it can't ever be stored safely and also be useful. So it needs to be stored "safely enough" but also with limited usability. What it all comes down to is a system that requires end-to-end user accountability. As it stands now, "identity theft victims" are held accountable for EVERYONE's mistakes. It's just not fair.
The correct term is "data breach", not "data breech."
A "breech" is either a pair of short pants ("breeches"), the hind end of the body or a birth where the baby is coming out backward ("breech birth"), or the rear of the barrel of a firearm.
So the term "data breech" means short pants made from data, data that is coming out of a system backward, or the back end of an Ethernet cable, I suppose.
This teaching moment sponsored a chunk of my karma from the inevitable "Offtopic" and "Troll" mods this post will undoubtedly earn me.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
... that is clearly being misused by a section of the upper class against everyone below them.
It is a social wrong that must be collectively opposed by the public. If you do not agree to this point of view, you are either ignorant, gullible, blind or from the controlling upper class.
2. If the financial fraud was all that mattered, then this wouldn't really be a big deal. But the huge problems certain people have when their credit is destroyed are not being properly dealt with by the courts. We need to modernize our credit laws to negate the personal problems created when fraud destroys someone credit history. Among other things, changing the rules for social security number re-issuing (right now this is very hard to do, even if fraud is proven).
3. This combination of lax credit companies encouraging fraud, then ignoring the huge personal problems because the financial cost is low needs to be dealt with. For example, we could pass a simple law that solves the problem in a two step manner: a) allow a second social security numbers to be issued to anyone willing to have their fingerprints, retina patterns, and photo attached to the new number, at a cost of $1000. b) Allow the consumer to force their credit card company to pay that $1000 if the company did not properly and ACTIVELY investigate any potential fraud. "We did nothing wrong" should not be enough, they need to do things right.
excitingthingstodo.blogspot.com
Anybody who uses a card with the Visa or MasterCard logo which is connected directly to his bank account (a so-called "check card") deserves what he gets.
Is it fair that you have to worry for decades and pay for further credit monitoring when they are to blame for your information ending up in the wrong hands?
For fuck's sake, is it fair that someone stole your data in the first place? No, of course it isn't. But ultimately, it's your problem and nobody else's. Trying to make it someone else's problem is childish and irresponsible. They did their best (at least for the amount of money you spent on the service), but there hasn't been a security system invented that is 100% foolproof. So now you have to watch your information like a hawk because someone is a thief. You can hire that out too if you want, but there is a chance it will happen again. There was a chance it could happen even if you were managing your information security yourself. Thieves take shit that doesn't belong to them. It sucks but it's reality.
Life isn't fair - deal with it!
Christ.
Security is mostly a superstition... Avoiding danger is no safer in the long run than outright exposure. - Helen Keller
If you store someone's sensitive information, and their ID is compromised using any of the information you store, you're liable (along with everyone else that stores that info) for reimbursing any costs or lost assets that the victims incur.
As a bonus, this system would be a strong disincentive to storing crap about us that companies don't absolutely require.
The chain of events should look like: you go into a bank and ID yourself with a piece of government issued photo id. Then you can open an account or get a mortgage. Otherwise, you can't. Next up, to do a credit transaction when the card is not physically present, you get a text on your mobile phone that you need to send back. Everyone has a goddamned mobile phone capable of sending messages. By the way? This is how it works in many European countries. Also, for online purchases, virtual cards especially one-time virtual card numbers should be used...
Not to sound condescending, but when you hand your stuff over to a third party generally there is a contract signed between you and them, what you are looking for *should* be in that contract.
Really?
Do you have such a contract with your bank/financial institution?
The school/university you last attended?
Your employer?
Your local/state/provincial/national government?
Yes, I'm sure they all have privacy policies, which all boil down to "We'll do our best, but if we screw up, sucks to be you." What is your recourse under the "contract" if the entity violates its stated policy as a result of negligence on the part of its employees?
Let me guess... the bank you're CEO of got a government bailout?
Free Martian Whores!
There are thrity million illegal aliens in the US. They work without showing ID or showing laughable ID. I have personally watched one open a bank account without showing a single blessed thing. Stood right there and watched the entire sign up process, the bank did NOT ask for any ID, took the illegals word on everything, and had a convenient foreign language speaker teller do the assisting. I was three feet away standing in line, saw it happen. They get drivers licenses in a lot of places, and all sorts of other goodies, can open any utility service they want, etc. free medical care for any sniffle at any emergency room. Free schooling for their anchor babies. The feds are now going to sue a state to keep that "no ID verification needed" practice up and running. They can sign up for and receive free or heavily subsidized college education, whereas legal citizens have to pay through the nose and show valid ID.
ID that is even remotely verifiable is only for the legal honest citizens, if you are illegal, the government doesn't seem to care very much. Heck, they will arrest (for committing some nasty crime) and deport illegals numerous times in a row, but they still come back and can do whatever they want, no ID of any consequence or verification required. ID is the last thing they worry about, it's a joke.
Maybe you should find a bank that will just let you have access with the SSN or such blocked and tell them to let you withdraw with your ATM card or against (nationally issued) ID verification only. You may not have realized this but signatures on checks / credit cards are also ridiculously insecure, same as your SSN.
At worst, you'll only find such a bank account abroads - however, they're easy to find anywhere else but in the US. Put your savings there, use the national account only for more frequent payments - if it only has a few thousand bucks in there and won't allow overdraft, the risk is very limited.
If you don't like ID theft, try fraud. That's what it is. Garnering of unearned wealth by deception. But that then brings it to the banks who have to refund your account if it's affected by fraud, whereas ID theft is YOUR problem.
You specifically spewed forth:
So, you basically think that banks should be able to give out credit on whatever terms they want, even if it involves giving out loans in other people's names. That's why, in an actual civilized society, we have these things called "laws" which punish harmful behavior like this.
I know people like you hate the idea that people might actually have to obey laws and not screw innocent people over, but those of us who like living in reality prefer to have some semblance of civilization around.
Wollt ihr den totalen Krieg?
You can't see how having reasonable lending procedures and laws, as well as holding banks accountable for shady practices is a good idea? And you call *me* an idiot (and in ALL CAPS, no less). By the way, if you have to shout your point of view, rather than simply stating it, perhaps you should review what you believe. It's generally a sign that you don't have a clue. But, good luck with your "I'M RIGHT BECAUSE I TYPE IN ALL CAPS" meme.
Wollt ihr den totalen Krieg?