Rogue Employees Sell World Cup Fans' Passport Data
An anonymous reader writes "Reports are coming in that the Information Commissioner's Office has started investigating FIFA, the world football governing body, over allegations that details of thousands of World Cup fans' — including their passport data — were accessed by one or more members of staff and then sold on the black market. It is alleged that the details of more than 35,000 English fans — who visited Germany for the 2006 World Cup — had their passport and allied data sold to ticket touts for marketing purposes."
It is alleged that the details of more than 35,000 English fans -- who visited Germany for the 2006 World Cup -- had their passport and allied data sold to ticket touts for marketing purposes."
No wonder, they're scalpers.
Twitter supports and protects racists - by smearing their critics with the "Hate Speech" label.
When they catch the people who did this, they should be forced to listen to those vuvuzelas at high volume until their ears bleed. That'll teach 'em.
------
www.moneybythenumbers.com
Fear!
Uncertainty!
Doubt!
While I think the media does all they can to sensationalize everything maybe in this case it is warranted?
Why would FIFA even have passport data at all? At what point to they collect passport data from attendees? What happens if you refuse to show them your passport?
Why did FIFA have the "passport data" of fans at all?
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
It is alleged that the details of more than 35,000 English fans -- who visited Germany for the 2006 World Cup -- had their passport and allied data sold to ticket touts for marketing purposes.
How dare they do this without being a corporation! Now I'm going to go use my Mastercard on Amazon, have essentially the same thing happen, twice, and nobody will say a word.
Admittedly, the passport data angle is a new twist, but the advertising companies that bought the data don't actually care about the passport number, just the mailing address.
Stop-Prism.org: Opt Out of Surveillance
Are they caotic?
"Never mention the war"
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
http://www.guardian.co.uk/football/2010/sep/05/fifa-passports-claims The most interesting bit is that Sepp Blatter's nephew is involved with the company at fault.
... will be charged with releasing the passport data in his attempt for 100% transparency of all government records, including passports, but he will deny it and claim that the data was actually stolen and then released by the CIA as part of the dirty tricks campaign against him.
I've worked for several "big" companies, and this is a common problem:
1. Outsourcing - Has too much access, particularly the Philippines and India are getting access to peoples SSN's, I still wonder why the hell any company outsources their customer service when the only thing they can use to verify the account is a SSN. Good god. These people should only be provided with the customer's first name, and electronic verification only (eg that ASSET TAG number on your PC), not be re-verifying the account. Hell customers should be warned they are speaking with a foreign call center and advised in the pre-call/hold message not to share personal information. Banks continue to be stupid about it.
2. Internal security is all an act - Sure your email might be monitored, but there isn't 1 supervisor for every 1 staff member. As with the story here, nearly all employees have too much access to sensitive information, and ---have the time to steal it---, if your staff is not on call/interacting with that customer, they should not have access to any customer information. If I really wanted to call the president of the US, all I had to do is type his name in, and then, write, yes with a pencil, it down on paper, and stick it my pocket. Yes I may get fired tomorrow if someone was watching, but nobody watches. Bored staff become curious staff, and curious staff who feel anger at someone may strike back.
3. "smart" employees may be your best defence, or you largest liability, it depends how you treat them. I've seen more staff who were capable of covertly stealing information, should they want to, also tell managers about it and managers shrug it off. God, this one supervisor at one place I worked (who was absent 30% of the time) couldn't understand even the most basic security problems. Staff start sharing passwords because of incompetency or too much complexity in the password system. One call center had me memorize 11 unique logins and passwords, some of the systems permitted or prevented certain combinations or reuse. Another only had 2 logins (one for the PC, one for the CRM) Can you guess which system got abused? The more complex one did. All it would have taken to lock out every employee out of that system is one simple VBscript to enter every employee name (first letter+last name) and the default password. What's worse at there was a metrics program designed to use this security flaw that would have stopped working.
What exactly does my passport data reveal about me? Here's what (with US passports anyway):
- My name (for common names, no big deal)
- My birthday (kinda private, but I give i
- My gender
- My birthplace
- Where I got my passport (issuing authority)
- Date validity (when I got it and when it expires)
That's it.
My name is not exactly a secret (I give it to total strangers all the time). Plus, it's a common one in the US, so (obviously) a lot of people have it.
My birthday is kind of personal, but there very little someone could do with it without having more data.
My gender is easily guessable once you know my first name.
My birthplace lists only the country, and not the city. Useless.
My issuing authority is even less specific: 'US Department of State'.
Date validity is also useless.
It's not as if my passport lists my SSN, home address, credit history, or anything else that can be used to steal my money or identity. Perhaps they have a lot more personal info in other countries' passports, but not in mine.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
For security, credit cards rely upon... nobody who has ever run your credit card being hacked. For security passports rely upon... nobody who has ever recorded your passport being hacked. This is just not secure! By design, this system can *never* adequately secure people's information, because information alone is not secure enough for a transaction.
Options:
Credit cards pass through a Visa or MC controlled layer. Visa or MC then authorize a new single-merchant / single client code combination, which will work at that merchant but no others. The merchant never sees the original credit card number.
A passport decryption chip, which takes the original passport number, a country request number, and munges it in subtle ways, so that the selected passport number relates the the specific person, but the passport country code is hidden within the resultant displayed passport number.
A 2nd piece of information that by agreement can never be stored, but can be used to permanently authorize a particular merchant. For example, the first time you purchased something from Amazon.com, you'd be required to enter your visa password through a visa-controlled interface. Afterwards, Amazon would be allowed to utilize your credit card. This would include recurring billing.
The ______ Agenda
In this case, one of the staff members is selling the data off. Really, what's to stop this from occurring in government offices, or anything else? If price-to-gain > possible repercussions, then there is a chance staff will do something like this.
Working as a contractor, I have (many times) had access to very sensitive data. It's interesting how lax companies are with this stuff, and especially the government.. I think this story is just going to repeat again and again for governments, companies, etc (like it already has been). So, what's the real solution?
Why is your passport # needed to buy a ticket?
When did /. turned far right?
New Economic Perspectives
Sounds like someone ate all the pies.
The Boston Red Sox make a point of making their ticket prices a bit low, so that they get credit for a sell-out as the scalpers pick them up; this also moves unsold-ticket risk form the owners to the scalpers.
Figures; I got the tix for the 2 games I went to off StubHub.
Several dozen games in the same place might be different from concerts spread out over the country/continent/world (with 1, maybe 2 or 3, stops per city), I don't know.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
they could just as easily bash your preferred forms of entertainment. Just as valid - or just as invalid.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
Okay, I understand that the data breach is the main point of TFA.
However, the rational economist in me finds it hard to get angry about scalping itself.
Either the lowered initial ticket prices are irrational, or rational in some non-obvious/non-direct manner.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
and is considered market manipulation and is actionable under securities and commodities regulations. But usually when someone tries to corner a market, the operators of that market just change the rules of the market temporarily to totally screw over the guy doing the cornering. Not sure how that would work with scalping.
I guess that FIFA will be changing it"s name to THIEFA real soon.