Slashdot Mirror
Morgan Stanley Employee Pleads Guilty In Data Breach Case
An anonymous reader writes: A former Morgan Stanley financial adviser who was fired in connection with a major breach of client information pleaded guilty to accessing client data and taking it home with him. According to court records Galen Marsh copied names, addresses, account numbers, investment information and other data for approximately 730,000 accounts. "This action, which follows Morgan Stanley's initial investigation and reporting of his misconduct, makes clear that misuse of client account information will not be tolerated," the bank said in a statement.
The only thing that's weird about that is that is wasn't while leaving the company. Typically financial advisors do a data dumb of their clients and holding when they decide to switch to a different firm. The moment the advisor puts in notice a whole team of people work to contact customers to get permission to move so that the assets can be re-papered under the new firm. It's not unusual for a team to meet with an advisor and personally fly the paperwork/data back to the home office in order to speed up the transition.
It is standard policy to not bring home customer data or download it. Now, Morgan Stanley might have different rules than places I have worked, but chances are, they are the same. You can only access customer data from the corporate network, and you cannot download it, ever. Just breaking that rule would be enough to get him terminated immediately.
Criminal charges would then depend on what he did with the data, or if he failed to protect it. If he was the source of the breach, he violated company policy to do the download, and then there was a compromise of data, then any applicable laws would apply to the downloader. He knew the rules, he broke them.
Now, did his downloading of the files actually cause the breach? No idea.
People have this idea that it is still MS's fault anyway just because they didn't airgap the information in an Mission Impossible style vault. That's not realistic. They take steps to protect it, but data like that is used for legitimate purposes. Some people have to be able to access it. That is why there is a lot of policy wrapped around what authorized people are allowed to do with the date. He had a choice to break the policy, and if there was criminal liability, he's liable for it.
Yup. Right after that I think: "I bet this guy's job performance would have tanked if he was the only one who didn't take work home or on travel."
You know what's funny? Sales-critters stealing client contact info (to start their own businesses, take it with them to a competitor, etc) used to be almost standard operating procedure 20-30+ years ago...
Quo usque tandem abutere, Nimbus, patientia nostra?
" misuse of client account information by any agency other than Morgan Stanley will not be tolerated"
FTF Them
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Still does happen, but now there's the extra risk that the public cares about that data now more than ever. If that sales critter isn't careful he will not be able to prevent himself from being either the target of an actual breach or the fall guy for a breach. The game is now a lot more dangerous if you aren't as smart as you are unscrupulous.
... for a long time. Or at all.
But here is the dirty little secret of all Data Leakage Detection and Prevention software: It does not work except against fully clueless people. It is basically just intimidation but lacks actual teeth. The only way to prevent data leakage is by treating your employees well and respect them. Because employee loyalty is the only thing that helps. I guess these companies have forgotten that little fact and are now paying the price for that.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Since the problem has been taken care of, we see no need to change any of our policies, in particular spending on security. Your life savings are very important to us.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
They do not allow it. It happens anyways. FAs take their client data home when they plan to switch firms for some big recruiting bonus, but it is actually against every firm's policy for FAs to take client data out of the office.
Basically, high end financial advisors and their employers have a large argument about who the clients "belong to".
Both the brokers and the employers claim the clients are THEIRS. Which means that when they quit their job, they each try to 'keep the clients'. The employers claim 'we gave you the leads that lead to that client', while the brokers claim "I spent 3 years building a relationship - even letting that client beat me at golf and I HATE golf."
The Employers do not for example tell the clients were the new broker went to, even if the clients ask. Instead, they often accuse the brokers (as in press legal charges and try for injunctions) and prevent them from talking to the clients after they quit. It's gets so bad that some employers might try to prevent a broker from talking to his own father, because they claim his father is a client of the Employer, not the broker.
The brokers often copy as much information as possible about their clients, not just phone numbers, but financial statements, etc. You need this information to give the clients real service. You can't tell all your clients with trust accounts about the new financial trust services at your new firm if you don't know which clients have trust accounts.
If the broker took someone else's clients, than he clearly broke the law. But if he simply copied records of people he had a relationship with - i.e. his own clients - then Morgan Stanley is simply being a douchebag company accusing him of violating privacy when THEY are the one violating the privacy.
Let's be honest here - the real truth is the CLIENT should be allowed to determine who they want to do business with. If the client wanted to do business with Morgan Stanley, then the broker should not keep their information - but it is reasonable for them to take it with them when they switch jobs as they can't tell the client they are quitting until after they quit and they need that information to attempt to make the sale.
If the Client wants to keep business with the Broker, than Morgan Stanley should delete all their information after the switch is made.
excitingthingstodo.blogspot.com
I read "Morgan Stanley Pleads Guilty " and got hopeful they finally got prosecuted. I guess no such luck....
Now Hillary essentially took home Top Secret information by hosting it on her private server and none of you fools give a crap.
If you are truly so blinded by partisan bigotry that you take _any_ politician at their word, seek professional help after turning in your voter card.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
keyed to his DNA.
Lucky for him they don't exist yet.
Absolute statements are never true
No, they don't allow others to financially gain from information they own.
Only MS can profit from doing identity theft on their victims er clients.
Sleep your way to a whiter smile...date a dentist!
No, the fact that it was available to him doesn't mean he had the right to take it home. He probably needed to access it to do his day's work. He knew he wasn't allowed to take it home and still did it, so he's getting sued. Sounds reasonable.
It's a hard pushed analogy, but butchers need knives to do their day's work, that doesn't mean they're allowed to use them to stab their colleagues. They know that, and if they do it, they get prosecuted for it.
Of course your right... It is not as though Hillary has ever lied to the American public. Has Hillary ever been involved in a controversy where it turned out she "massaged" the details (a.k.a lied). So we should just take her abd all Politicians at their word.