40 Million Identities Up For Sale On the Web 245
An anonymous reader writes "Highly sensitive financial information, including credit card details, bank account numbers, telephone numbers, and even PINs are available to the highest bidder. The information being traded on the Web has been intercepted by a British company and collated into a single database for the first time. The Lucid Intelligence database contains the records of 40 million people worldwide, mostly Americans; four million are Britons. Security experts described the database as the largest of its kind in the world. The database is in the hands of Colin Holder, a retired senior Metropolitan police officer who served on the fraud squad. He has collected the information over the past four years. His sources include law enforcement from around the world, such as British police and the FBI, anti-phishing and hacking campaigners, and members of the public. Mr. Holder said he has invested £160,000 in the venture so far. He plans to offset the cost by charging members of the public for access to his database to check whether their data security has been breached."
Where does a cop get £160,000? (Score:3, Insightful)
He saved up?
Isn't it a crime (Score:1, Insightful)
for a hacker to have that information on their computer. So how is it legal for a company to keep all of that information. Not to mention making the company publicly known will make it a huge target for hackers as now every single person knows that if they get in there is 40 million identies they can have.
Seems to me that legally it should be shut down and every single person in the database be informed that their identiy has been stolen. . . twice it would seem.
1/10 of a cent per person (Score:4, Insightful)
Were you a victim of upskirt photography? (Score:3, Insightful)
I have put together a database of upskirt photos collected from the internet. For a small fee you can peruse my collection and find out if you were a victim.
Re:splitting hairs (Score:3, Insightful)
"He plans to offset the cost by charging members of the public for access to his database to check whether their data security has been breached."
How, exactly, does this differ from extortion?
Because he wasn't the one who stole the information in the first place. He's merely offering a service to let you know if you've been the victim of a crime. This is very valuable information, as it could prompt you to cancel credit cards, or change PIN numbers. He had to incur some expenses to acquire this information so why should he give it away for free? The criminals are the ones that stole the information in the first place.
Re:If he has my sensitive data... (Score:5, Insightful)
If you're in the UK then as long as the data isn't held securely by him then yes. The UK's data protection act requires that all information that can be used to personally identify an individual is held securely.
If you're in the UK you can also use the Freedom of Information act to request any information he's holding about you, but for that he can charge a nominal fee, which is how he's probably planning on making the money invested back.
A former member of the metropolitan police and corrupt? Don't colour me surprised.
Re:Where does a cop get £160,000? (Score:5, Insightful)
And now the git wants us to pay for stolen information, obtained from publicly funded sources utilising his publicly funded connections to acquire. Whatever his previous achievements in the Met may or may not have been, now he is simply a slimy scammer trading in stolen goods. The man is a disgrace.
Cheers,
Ian
Re:splitting hairs (Score:4, Insightful)
I am in no way defending the practice.
Re:splitting hairs (Score:3, Insightful)
So if I buy some stolen goods from a thief and then sell that stuff back to the original owners, then I'm fine because I'm not the one who has stolen the stuff? I don't think so.
So why is this case different?
Re:splitting hairs (Score:3, Insightful)
Because he wasn't the one who stole the information in the first place. He's merely offering a service to let you know if you've been the victim of a crime. This is very valuable information, as it could prompt you to cancel credit cards, or change PIN numbers. He had to incur some expenses to acquire this information so why should he give it away for free? The criminals are the ones that stole the information in the first place.
That depends on when he acquired it, and the resources he used. If he acquired it on the job, or using government equipment and/or connections, then it's the government's information and he doesn't have the right to sell it. If this was a "post-retirement" project he's been working on, then it would be legal.
Is mine there? How much did it go for? Only That?! (Score:4, Insightful)
Well then, I'd like it *back* please. I wasn't done using it yet. You can have it after I'm finished.
Re:splitting hairs (Score:5, Insightful)
If this was a "post-retirement" project he's been working on, then it would be legal.
No it wouldn't. This guy has no legal basis to acquire or retain this data, he's in very serious breach of the UK Data Protection Act.
Re:Isn't it a crime (Score:4, Insightful)
Yes... but HOW, exactly, has he collected this information? It appears to be by using all sorts of connections all over the world, who are providing him with data and using the time and money of the State or Nation that employs them.
That has got to be a crime. It had damn well better be a crime.
Re:Where does a cop get £160,000? (Score:3, Insightful)
It's his right to do whatever he wants with his pension. If he wants to create a database of stolen identities, he can do that. And if he asks for payment to see if you are inside it, he can also do that.
He just can't do anything nefarious or illegal with it.
Prosecute for possesion of stolen property (Score:4, Insightful)
Re:Where does a cop get £160,000? (Score:5, Insightful)
Like ... actually having the information in the first place without permission of the owners of the data. The only legal thing he can do with it is destroy it.
I certainly have not authorized him to use my information.
A discussion on morality. (Score:3, Insightful)
I'm interested in hearing people's thoughts on the morality of this sale. Sales like these are completely non-unique, with one prominent example being the credit score business in the United States. As far as I know, Americans are only entitled to know their credit score for free twice a year, and no more. Additionally, lenders don't provide any fair warning that a person's credit score is at risk; in fact, younger credit card owners are encouraged to use their credit cards as primary spending sources with sign-up incentives and looser overall operating conditions.
Personally, I think that it's completely immoral to charge people for knowing whether their most treasured assets are at risk. Just don't let CNN know about it; I really don't want to deal with a full work day of them discussing privacy breaches, credit card fraud and how this all impacts Obama and Michael Jackson. (He's still dead.)
Re:Isn't it a crime (Score:5, Insightful)
The pro-piracy folks around here say that copying isn't theft. I'd say that'd apply here too.
Not just the pro-piracy folks. Although I'd like to see reform, I am in favour of copyright. Incorrectly defining terms makes sensible discussion of a topic difficult or even impossible.
This topic doesn't inflame the argument so much because there is not a substantial portion of people who want "identity theft" to be legal. Since there is no debate on whether it should be allowed or not, using an incorrect term doesn't highjack the argument into being propaganda for one side. Theft and stealing are terms commonly used to describe things that are not in fact theft. That's usually ok, but when discussing proposed changes to laws that affect the whose society it isn't. For example, I would regard MPAA equating copying a movie with stealing a car, repetitively making that connection in the absence of opposing argument to the general population (on DVDs) as tainting the jury pool.
A teenage girl might accuse another of "stealing" her boyfriend. No problem, until you start proposing laws to have boyfriend thieves charged with theft. At that point, it would be necessary to point out the differences and that "stealing" is not really an appropriate term for what happened. That's where we are with copyright right now. In identity theft cases, I'm not sure there is a word to properly describe it yet. It is usually done in order to commit fraud, but the harvesting of the identity info is only the first step and probably isn't fraud in and of itself. Although fraud and theft are different, common usage of theft includes fraud, so theft is perhaps the best word to use right now even though it isn't exactly correct.
Re:Where does a cop get £160,000? (Score:3, Insightful)
Oh, it's illegal all right. In many countries. Just because the US government doesn't give a crap about privacy, doesn't mean other countries don't.
Re:So let me get this straight... (Score:5, Insightful)
More than a little fishy. I read this as, "British fraud officer leaves the force, collects the personal information of 40 million people from the black market and his buddies in law enforcement, and is now using it to make money. Oh, but it's not unethical this time because he used to be a policeman." If it was illegal for the phishers and fraudsters to have this ill-gained information, why is it not illegal for a former police officer to have it?
I know there are no privacy laws in Britain, but here in the U.S., I would hope that there's a law providing for the destruction of personal and/or financial details that were obtained illegally once they are no longer considered evidence in an ongoing prosecution.
Re:If he has my sensitive data... (Score:3, Insightful)
The problem is that it's not very secure because there's a finite search space. If the database and system were illicitly copied, a dictionary attack (aka "preparing a rainbow table") would serve well to "unhash" most of the data in the database.
There are only 60 million Britons, and you can probably get or guess a good share of their names. Input them into the hashing routine, and you get a hash: let's say that "JOHN SMYTHE" hashes to "abc123". Next, you generate the 100 million possible taxpayer identification numbers, and hash those: "111-22-33-444" hashes to "def456". Once you've built the rainbow tables, if you look in the database and find a row with "abc123 def456", you know that JOHN SMYTHE's taxpayer number is 111-22-33-444. You know everybody's taxpayer number.
Salting the hashes makes the problem harder, but you can't salt an index value or it's unsearchable. So key columns are going to be unsalted. And what are likely to be the key columns? Name and TIN.
Hashing only secures data when there is an infinite set of probable values. There is not an infinite set of names or TINs.
Re:A discussion on morality. (Score:3, Insightful)
Yanks are eligible for a free report once a year, from each of the three credit bureaus, so the smart ones of us space them out and get one at a time. www.annualcreditreport.com [annualcreditreport.com]. They don't give us the actual score, that varies by bureau and costs extra, just the report. It's meant to find inaccurate information. We also do get free reports (you have to request it) when credit is denied because of one of those bureaus.
Re:splitting hairs (Score:3, Insightful)
"Hi, my buddies and I would like to pool the information we have to check to see if we're on your list. My name is Mr Adams, and my friends names are: Taylor, Brown, Davis, Evans, Wilson, Thomas, Johnson, Roberts, Robinson, Thompson, Wright, Walker, White, Edwards, Hughes, Green, Hall, Harris, Lucas, and Price. Take your time, we want you to be thorough."
Re:Ethics? Hello? UK? Anyone home? (Score:3, Insightful)
Day 2: Racist indoctrination training.
Day 3: Brutality training.
Day 4: Smart-arse, holier than thou training.
Day 5: 10 minute test.
So peddling stolen goods is legal now (Score:2, Insightful)