Slashdot Log In
100 Million Victims of Data Theft
Posted by
kdawson
on Mon Dec 18, 2006 01:01 AM
from the and-counting dept.
from the and-counting dept.
jcatcw writes "With the latest significant data breach — theft of a Boeing laptop with unencrypted personal information on 382,000 employees — the Privacy Rights Clearinghouse estimates that the total number of data breach victims has passed 100 million since they started tracking in February 2005. The director, Beth Givens, admits 'the number 100 million is largely a fictional number,' but it surely errs on the low side. Since California is still the only state with disclosure laws, incidents are difficult to analyze fully. However, Congress this week passed a bill requiring that the Department of Veterans Affairs report breaches."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I don't trust the article (Score:5, Funny)
I dunno (Score:3, Funny)
Re: (Score:3, Funny)
We need to think how transactions are processed (Score:5, Insightful)
I don't know what to do to solve this, any suggestions?
(Way back when, my friend who worked at a Sam Goody used to actually check credit cards when customers bought something on his first day on the job. After the manager caught wind that he denied someone using their friend's mom's credit card, supposedly with permission, he got yelled at and told not to do it again. I can't help but think that the laws are too lax in this area and the industry has little interest fixing it.)
Re:We need to think how transactions are processed (Score:4, Funny)
On a side note, why is it that I get all these credit card offers from companies whom already have my SSN, I know you got it guys, and they tell me I'm "pre-approved" for credit, and yet I have to send all this info in?
Come on big brother! If'n you're going to know everything about me please dont make me fill out all the damn forms in triplicate!
Parent
From TFA (Score:4, Insightful)
From the article: "A stolen laptop at The Boeing Co. has pushed a widely watched tally of U.S. data breach victims past the 100 million mark". Saying that the 100M people are thought to have had data disclosed about them is not the same as saying that 100M people are known victims of identity theft.
Parent
I was counted twice! (Score:5, Interesting)
Parent
They don't know actually (Score:4, Informative)
You can opt out of this if you want, you have to contact the credit bureaus and tell them to quit giving out your info for this and they will.
Parent
Re: (Score:3)
Re: (Score:3, Insightful)
Do it the same way that you make companies care about any other type of public safety issue. Make it very painful for them if they fail to protect the data. If they lose privacy data they should be completely liable for any damages that occur. A couple of major class action lawsuits and we can make it so that companies won't want to collect privacy data except when absolutely needed.
Re: (Score:2)
One of my banks has quite a sensible system; I select a password, bu
Re: (Score:2)
Yep, absolutely. This is the way forward, and it's long overdue. Awards of 100% of real damages plus statutory punitive damages of $100 per victim per incident if negligence is demonstrated would do the trick real quick, I'd imagine.
Re:We need to think how transactions are processed (Score:5, Insightful)
Of course as long as its easy to get hold of your cash or get credit, someone will want to exploit that to get hold of cash or credit in your name. So making it harder to commit fraud or identity theft is really only beneficial to the customer, which in turn means that the only path to making it harder to commit fraud or identity theft is to introduce legislation or regulation to make it happen. That of course is opposed by the banks and merchants (as they lose out) and opposed by the majority of customers as they don't see that there is a problem until it happens to them.
So yeah, apart from not seeing an easy solution for the banks and merchants, I also don't really see a will to implement any solution which decreases the amount of spending or credit applications, or one that will cost money to roll out (after all most organisations are looking at short term profit not long term strategy's).
Parent
Re:We need to think how transactions are processed (Score:5, Interesting)
I solved this problem ages ago. Some guy, actually two of them, invented something called the Diffie-Hellman Public Key Encryption Algorithm. Since then we've had dozens of these show up and now have RSA and DSA/ElGamal out there. Pretty much, with huge (1024 byte!) challenges and hardware devices with your key in them, as well as transferable One Time Pads (so you can let someone else use your credit card once, twice, for $5, for $10...), you can make it so everyone along the way can verify your identity and nobody along the way can pretend to be you.
The system drawn out isn't that complex. It's lazy distributed too; anyone can cache your public key, so anyone can independently verify you over and over again. This means that the store can verify your card isn't a spoofer and not pester the credit card company with it if it is; and if it's not, then the credit card company can also verify your card isn't a spoofer (and that the store isn't sliding in extra charges after you've signed for the price) and not pester the national PKI network with it.
Parent
Re: (Score:2)
The real problem is that the information that identifies you as you is the same information that you give to people to prove that you are you.
Giving anyone you need to prove your identity to all the information they need to pretend to be you.
What is needed is something on long the lines of public-private key cryptography.
Re: (Score:3, Insightful)
Re: (Score:2)
-dave
Re: (Score:2)
1) Address the ignorance factor first. Make sure people are aware of the issue of data security and the seriousness of it. Don't assume they automatically know. Explain it to them in a way that is informative and not condescending.
2) Use a platform designed to keep users in userland.
3) Setup laptops with encrypted filesystems [0] and encrypted connections [1]. Do not give users administrative access. Re-image [2] system partitions for extra fr
Re:kill me, Slashdot, for I haven't the nerve myse (Score:5, Insightful)
It isn't too late. But you have a tough choice to make. You can either choose to make your life better, or choose to let life push you around. Changing is not easy.
Read Sartre, Camus, Nietzsche.
Pull your ethernet cable, unplug your wireless router. Take some time off of the
Think about your goals -- both the failed and incomplete. Ask yourself why the failed ones failed. Resolve to fix the problems that caused them to fail. Evaluate your incomplete goals. Make plans to finish them. Commit to your plans.
Exercise is good for you. I don't mean to make fun of your belly. But you obviously need to become stronger to become the man you want to be.
Don't sweat being bald.
You've wasted a lot of time, but you're still young. There's no point wasting any more.
Parent
Personal Information (Score:2, Insightful)
I wish I was the copyright holder, and protected by the applicable laws, of my own personal information.
Re: (Score:2)
That said I can see the downside, it "legitimizes" even more draconian copyright legislation- instead of relying on "Think of the artists!" they could rely on "Think of the identity thieves!"
Re: (Score:2)
I wish I was the copyright holder, and protected by the applicable laws, of my own personal information.
Copyright is fucked up enough already. I shudder to think how legislation trying to do this would make it worse.
I smell BS (Score:2)
I've heard many stories about your uncle, he's the Baron Munchausen [imdb.com], right?
By obtaining a drivers license you are agreeing to abide by the motor vehicle laws. If you don't have a drivers license and you know what you are doing, they can't touch you for breaking any of the laws
Your story would go well as a light comedy movie script, but it doesn't stand the hard test of reality. That's not how democracy, or any othe
100 million.. six months ago! (Score:4, Informative)
How much of the information is... (Score:2)
another announcement (Score:2, Funny)
I wonder... (Score:2, Insightful)
I never read of anyone having suffered consequences as a result of someone losing their data. Why is that?
Doesn't it seem as if there would be a few major class action lawsuits, at the very least? You'd think every time data loss occurs on this large a scale, it would be followed by droves of people suffering from identity theft or fraud
Re: (Score:3, Interesting)
I never read of anyone having suffered consequences as a result of someone losing their data. Why is that?
Doesn't it seem as if there would be a few major class action lawsuits, at the very least? You'd think every time data loss occurs on this large a scale, it would be followed by droves of people suffering from identity theft or fraud
You're correct: theft or loss of a machine doesn't automatically mean identity theft.
First, the machine should be in a working state which is sometimes not the case.
Then, th
Re: (Score:3, Insightful)
Because not many media outlets are interested in reporting on individuals who lose a few hundred dollars when they can throw around figures like 100,000+ victims in a single crime.
Protect yo'self (Score:3, Informative)
- Access to my credit report/score
- Big 3 credit bureau monitoring - notification of any new accounts or loans in my name
- Personal case officer (through the bank) if something happens
These services can be purchased for anywhere from $5 to $12 a month depending on the bank. I suppose I could still get burned but I can't imagine any of it could hurt, well worth the money at any rate in my mind.Re: (Score:2)
If they wanted to protect your identity, they'd make it harder to steal. Companies losing personal information aren't the problem, companies who casually take action based on very little information that will impact you when that information is lost is the real problem.
"Identity theft" is a meaningless term (Score:4, Interesting)
This is the basic scenario: A criminal poses as you to borrow money (usually with a credit card), and then whoever lent that person the money asks you to repay it.
Then there are generally 2 consequences for you: debt and reputation damage. The debt itself is usually the lesser of the two problems, since you're not legally obligated to repay money that someone else borrowed in your name. Reputation damage, on the other hand, is incredibly hard to repair. This usually takes the form of erroneous information on your credit report.
Private agencies (Equifax [equifax.com], Experian [experiangroup.com] and TransUnion [truecredit.com] are the majors in the USA) maintain this information of your past financial transactions, and sell it to potential lenders in the form of a credit report. Lenders then use this information to decide how risky it would be to lend you money. These credit reporting agencies err on the side of over-reporting negative information, because a defaulted loan from an under-qualified borrower costs banks and lenders much more than a qualified applicant being turned away. Additional services (like providing reportees an easy way to correct errors) would cost credit reporting agencies much more than their client lenders would be willing to pay for the increased accuracy, so they don't bother implementing them.
The short version is that banks and other lenders knowingly rely on imperfect information about potential borrowers, because it is the most economically sensible thing to do. It's not profitable for them to pay for more accurate information. If they decide not to lend you money, even based on erroneous information, it will likely be very hard to change their minds.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I much perfer "some-moron-is-buying-stuff-with-my-money-and-i-a
Re: (Score:2)
If you are not the only one "Jonboy X" that can prove that he is "Jonboy X" than you don't have identity. You are left with plurality at best ;-) You had identity before and now you don't have it anymore. Sounds pretty much like theft to me. Of course it is not only about the name. If someone can succesfully pretend to be you - including your debt history, providing correct address, SSN, CC # and your /. account ... - how do we know it is you? We don't. You lost your identification.
It's not so much the "identity" part that strikes me as odd; it's the "theft" part. When someone steals your television, they have it and you don't. When someone "steals" your identity, you still have it because you're still you. It's just that now, someone else has some information that can be used to impersonate you to people who don't check too closely.
Maybe everyone should periodically be able to buy a public/private cryptographic key pair that can be used to authenticate you. The higher your net w
Identity is not abstract data (Score:2)
I would agree with you if it was about copying data such as software, music, films, etc. But if someone has all the data that identifies you, he can effectively take it away from you. He can change your address so that all your mail goes
I found out last week I might be a victim. (Score:3, Interesting)
Their idea of taking care of the problem? Wanting me to register online (!!) or over the phone to be told if I was one of the victims, and also to get a free credit report or get credit monitoring, though they don't seem to think they should pay for that or for any fees I might get if I have been victimized...
Oh, and I only found out because it was in the local news.
Re: (Score:3)
Stolen from Car (Score:2)
Seriously, who carries around a Laptop with "Personal Information" of 382 Gazillion living, dead and zombie employees in a fscking Laptop and leaves it in a car unattended.
You would think they would store this information in a so-called safe server somewhere and have policies on not taking them around in Laptops. Why would you need that information on a laptop anyway ? For fsck sake - We're talking about serious personal information!
I say hire stewie
Re: (Score:2, Informative)
Stupidity (Score:3, Interesting)
You can enforce encryption on every file, strong passwords etc but sooner or later some smuck will print it out and forget to schred the printout when done. So it ends up on some dump available to anyone crawling around looking for something usable.
Designers of company security forget the most obvious and most dangerous threat: stupidity! My personal favorite quote used to illustrate exactly that is the following:
Fines? (Score:2)
For the love of God... (Score:5, Insightful)
I know it has been asked before, but WHY in the name of GOD does this kind of information need to be on a fucking laptop?!
My mother works at a VA hospitol and as such, has access to read and modify all the personal information necessary to commit identity theft on thousands of patients, and of course, she has a laptop computer issued by the hospitol so that she can work from afar. When she originally received it, it was nothing more than a Win2k box with VPN software, MS terminal services. All of the sensitive data was/is stored on the servers on their intranet. After a small "upgrade," the laptop was returned, only this time it came back with a full encryption setup. The interesting thing is that there is STILL no sensitive data stored on the laptop. It is, however, just as easily accessible. The point is, if someone stole that laptop, no sensitive data would be compromised, even if the encryption was broken (which probably wouldn't happen).
I don't fucking understand, why when we have the technology READILY available to completely prevent this kind of crap, that it isn't used. A shout out to all the companies on this planet: Centralize your damned security. Laptops cost $500. This kind of shit publicity and potential lawsuits cost a hell of a lot more.
Just a thought. (Score:2)
help "them" to want to change (Score:3, Interesting)
THE PROBLEM: It is currently financially worthwhile for some companies to play loose with personal information. The perceived costs of the consequences of poor protection are not sufficient to warrant a change in their way of doing business.
Many merchants / agencies / whatever don't seem to want to provide us additional protections. All it would take is for a few companies who already take security very seriously to sign up for the best star rating listed below, chalk it up to advertising expense, and put the pressure on the other merchants who do not sign up. "Hey! *WE* take your security seriously, and we put our money where our mouth is. If *WE* mess up, we clean it up and pay *YOU* for your inconvenience. Why would you want to deal with anyone else?"
There is a financial opportunity for an enterprising group to make a fortune here. Existing insurance companies provided graduated coverages and fees depending on certain items. I can select how much liability insurance I want for my car. I can pay the insurance company a larger premium for a greater amount of coverage. Alternatively, if I have certain protective measures in place, then my premiums can be reduced. I choose the level of coverage that works for me.
whenever there is a security breach, make a payment to each CONSUMER! Get the consumer to be your best ally in getting merchants to sign up for the protection. So, if a merchant compromises the security of MY information, then the insurance company sends ME a check. I'll leave it as an exercise for the reader on how this could be extended to cover other organizations that have access to personal info such as hospitals or government agencies.)
Also, and VERY important: advertise this feature like crazy - get the consumers to push the merchants to get the coverage along with an easy-to-remember grading scale for consumers to use to assess the degree of protection they are provided by a merchant. It took a few years, but now US car companies are advertising the NHTSA crash test ratings. [dot.gov] I expect the same could work for credit protection.
NOTE: All dollar amounts are pulled out of a hat. I'm just trying to put something concrete out there to use as a starting point for discussion. Obviously, the size of the covered merchant would affect the premiums and payouts, and I have NOT worked those into these numbers. Please offer improvements! The examples listed here might be appropriate for a moderate to large merchant.
Have a graduated scale of costs and coverages that depended on what level of security measures were in place at the time of the loss / theft.
If a merchant takes no security precautions then the insurance company would:
The consumer gets some benefits, even if the merchant makes no great effort to protect the user. It's still better than anything that the consumer is now getting. After a few payouts, word-of-mouth will boost interest by consumers in seeking out at lest this minimal coverage. CEOs and CIOs will start to take notice.
If a merchant takes certain, documented, security precautions ( encrypted DBMSs, firewalls) then the insurance company would:
Re: (Score:2, Interesting)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
Re: (Score:2)
Obligatory: Information wants to be free? It was trying to break free?