Does ID Theft Weigh-In On Immigration Debate?

by Sue B. Martines J.D. and Michael McCoy M.Sc.

“It’s a black and white issue,” the gal next to me on the plane volunteers, as she peers over at the newspaper article I’m reading about Arizona’s latest immigration law battle. And then it taints my entire train of thought -- is it as simple as that? Is it as simple as saying someone is either lawfully in this country or they’re not? Is it that you either jumped through the justice hoops and got it done or you need to go back from whence you came?

Foregoing the more esoteric consideration, perhaps, about whether borders are indeed a necessity, when identity theft is factored into the immigration debate, how can it ever be black and white? The July 16, 2010 USA Today article discusses how immigration is re-entering the national debate and is back in the spotlight for November’s races. But nowhere is identity theft addressed in the article.

And yet, there are dozens of websites where anyone with $20 and a credit card can buy a fake ID. You gotta wonder upon what document is the “sending one back from whence they came” based?

If an illegal immigrant turns into an identity thief by buying a Social Security number in order to remain in the U.S., and it’s happening at an alarming rate, then is there an additional argument in favor of such laws being looked at in Arizona – where immigration is reviewed with nearly every bust?

A Center for Immigration Studies article cites that approximately 75 percent of working-age illegal aliens use fraudulent Social Security cards to obtain employment. (And that was in 2009.)

Understandably, regardless of which end of the potentially black and white immigration spectrum one stands, there cannot be a laundry list of potential crimes to be evaluated with every charge, but identity theft needs to be factored into the mix somehow. In fact, if identity theft doesn’t weigh-in now, the immigration issues we’re facing may never really get addressed.

CPA’s, Identity Theft, and the Law

By: Sue B Martines J.D.

The attorneys may have gotten off the hook for the Red Flags Rule requirements, but so far, not the CPA’s, among other “professionals” (such as physicians). Picture this – two so-called “professionals,” one an attorney and one a CPA, discuss identity theft and the Red Flags Rule implemented by the FTC to help businesses develop “Red Flag” indicators for fraud – the conversation might go something like this:

Attorney, “being a busy professional, I sure am grateful to not have another burdensome requirement made of me by the government!”

CPA, “being a busy professional, I sure am grateful for the opportunity to have guidance on how to better guard against the time-consuming, professionally-damaging and high client impact of an identity theft or data breach!”

Two different professionals, two different treatments so far, by the law!

In a previous posting, we discussed the recent court decision finding attorneys exempt from the “burdensome” requirements of the Red Flags Rule; here we make the somewhat absurd double-standard comparison, you might say, to one of their counterparts -- CPA’s.

We all know there’s no immunity from identity theft risk. The American Institute of CPA’s itself fell prey to the #1 risk factor – human error – when in 2006 a damaged hard drive containing personal information was sent out for repair and was lost in transport. (http://www.pro2net.com/x52999.xml)

However, in an IRS online publication regarding CPA’s and identity theft, you will find zero things unique to the CPA that wouldn’t equally apply to an attorney! (http://www.irs.gov/pub/irs-utl/identity_theft_what_cpas_need_to_know.pdf)

Certainly the fight may not be over for CPA’s, or other “busy professionals” whose attorneys will challenge the Red Flags Rule “requirements” to have an identity theft prevention and mitigation plan in place by June 1, 2010.

Yet, if only all CPA’s could look at identity theft and data protection measures like the one in the discussion above – it could mean less lawsuits for the “burdened” attorneys, and better protection of client data!

Maybe the requirements of the law aren’t that bad of an idea after all!

Sue B Martines is a recovering attorney of 12 years now living in Oregon. Sue can be reached at, suebmartines@gmail.com

Red Flags Extension, Trends in ID Theft and Attorneys as “above” the law?

By Sue B. Martines J.D.

Any time there is an “exception to the rule,” as the saying goes, it feels like someone is getting off the hook.  And truth be told, most would say attorneys get off the hook all too often.   So here it comes again, with the latest argued exception to the thrice-postponed Red Flags Rule – attorneys shouldn’t have to create written policies outlining how they will prevent, detect and respond to identity fraud.

My, what a burden that might be for them!

But most laws are somewhat burdensome – especially when they’re first mandated and folks are figuring out how to comply.  So it comes as no surprise that the same has been true with businesses scrambling to determine if they are a “creditor” and thus, subject to the identity verification requirements of the “Red Flags Rule.” * The Federal Trade Commission (FTC), tasked with imposing the Rule designed to slow identity theft, lost its most recent battle defending the applicability of the Red Flags to attorneys.

In a  The Daily Record online posting, the FTC argues that as attorneys accept payments from their clients so they ought  be subject to the “creditor” requirements of the Red Flags Rule.  But this U.S. District Court for the District of Columbia sided with the American Bar Association, saying…what was it?  Ah yes, that that would be too “burdensome” on those hard-working attorneys!

Stay-tuned as the courts test the burden-ability of various acclaimed creditors between now and June 1, 2010 (the new deadline)!  And as The Record notes, the FTC can appeal the ruling.

Sue B Martines is a recovering attorney of 12 years now living in Oregon.

FTC Extends Enforcement Deadline for Identity Theft Red Flags Rule

FTC Reports -

At the request of Members of Congress, the Federal Trade Commission is delaying enforcement of the “Red Flags” Rule until June 1, 2010, for financial institutions and creditors subject to enforcement by the FTC.

On October 30, 2009, the U.S. District Court for the District of Columbia ruled that the FTC may not apply the Red Flags Rule to attorneys. Today’s announcement that the Commission will delay enforcement of the Rule until June 1, 2010, does not affect the separate timeline of that proceeding and any possible appeals. Nor does it affect other federal agencies’ ongoing enforcement for financial institutions and creditors subject to their oversight.

See FTC Entire Statement at: http://www.ftc.gov/opa/2009/10/redflags.shtm

Follow Michael McCoy on Twitter at : www.twitter.com/mccoynews

Ever Wanted to Publish an Article?

Ever wanted to publish an article? Have a interesting identity theft story?

Are you a internet security officer, banker, member of law enforcement or just have a good identity theft story to share?

Write a blog article, limit it to 325 words or less (in word) and submit to insurancenow@hotmail.com. If your article is professional, polished, and of the right subject matter we will publish it on www.thesilentcrime.com blog.

Remember to add your Name, Company and Title at the bottom of your article.

In the body of the email add your phone # so we can verify the source. By emailing us your article you give us full rights to publish your article now or anytime in the future.

Michael McCoy

“A great year for data thieves”

Recently a report from the Verizon Buisness RISK Team was released showing that over 285 million records were stolen last year, which is more then the past 4 years combined.

How was all this data lost and was it preventable? According to this report, 99% of it was from compromised servers and applications, 20% of that was from insiders within the company and 87% of the losses were easily preventable. The majority of the organizations, some 81%, weren’t even PII compliant.

"We find that many organizations achieve very high levels of security in numerous areas but neglect others," wrote Verizon. "Criminals will almost always prefer the easier route. Identifying a set of essential controls and ensuring their implementation across the organization without exception, and then moving on to more advanced controls where needed is a superior strategy against real-world attacks."

Read report here:
http://www.verizonbusiness.com/resources/security/reports/2009_databreach_rp.pdf

Employers offering ID Theft Services as a Voluntary Benefit. Finally!!

Below, I share a small portion of a recent article written in Business Insurance Magazine. You will find in this article additional statistics and quotes that backup our findings in "The Silent Crime" in regards to more employers and employees today are seeking identity theft services as a voluntary benefit.
The article also shares a new survey that states more people see identity theft as more then just a financial problem, they actually see it as a legal issue. As our subscribers know we have been trying to educate the consumer for many years of this fact, in our books, on our blog, and in our workshops around the world.
Maybe collectively we are all starting to make a difference.

"Continue to educate the masses one at a time and we will make a difference."
______________________________________________________________
Employers offering ID theft protection as voluntary benefit
KAREN PALLARITO
Legal service plans also becoming more common choices
Reacting to national crime statistics and marketplace demand, many group life insurers and legal service plans are offering identity theft protection as a voluntary employee benefit, experts say.
ID theft protection began turning up in voluntary benefits plans about five years ago. It's typically bundled with other types of coverage or offered as a rider, but it also may be sold as a stand-alone product.

The Society for Human Resource Management's 2008 Employee Benefits Survey showed that 24% of employers offered legal assistance among other voluntary benefits ...

In a soon-to-be-released national consumer survey, 34% of employees cited identity theft as a top personal finance event in which they were personally concerned from a legal standpoint.

"When the economy goes bad, typically we see crime go up," said Michael McCoy, a consultant to Pre-Paid Legal Services Inc. in Des Moines, Iowa, and co-author of "The Silent Crime: What You Need to Know About Identity Theft." The thieves are getting smarter, too, he said. Instead of robbing banks, they're hacking into computers and they're grabbing purses for more than the cash. "You might have a hundred bucks in there, but I just made several thousand from stealing your identity," Mr. McCoy said.

Providers cited prices for employees ranging from lows of $8 to $16 per employee per month to highs of $23 to $26, depending on the employer's size, demographics and range of services in the policy. The higher-priced products often include other legal services, such as will preparation. While most of the business is employee-pay only, some employers share the cost.

full article found at: http://www.businessinsurance.com/cgi-bin/article.pl?article_id=27082
____________________________________________________________________

If you have an article you would like us to share with others or want us to comment on please send me an email at: insurancenow@hotmail.com
Also, if you have written an article and would like us to publish it on our blog or assist you with having it published in your local markets please email me at the above email.

Data Breach - RBS WorldPay

In this videocast I share with you a letter I received from RBS WorldPay with a RE: title of "IMPORTANT NOTICE ABOUT YOUR PERSONAL INFORMATION". The letter begins by telling me how I am one of many involved in a massive data breach within RBS WorldPay.

The following is a direct quote from the letter. Remember, this is a letter I personally received.
___________________________________________________________________

RE: IMPORTANT NOTICE ABOUT YOUR PERSONAL INFORMATION

.

Dear Michael:

.

We are writing to inform you about a situation involving your personal information. We are investigating fraudulent activity as a result of unauthorized access to our system. Information such as your name, address, telephone number, date of birth, Social Security number, and financial account information may have been inappropriately accessed by an unauthorized person.

.

Our internal security professionals and outside experts are working with law enforcement authorities to investigate the situation. We are taking steps to help ensure that this type of event does not happen again.

.

What we are doing to protect your information:

.

We are offering you a complimentary one-year membership in XXXXXXXXX, a national subscription credit monitoring service that ...

____________________________________________________________________________________

Please view my videocast to hear my take on this letter.

http://www.youtube.com/watch?v=KgMzPI4SdWE

Second video of 2009

Britain - Here We Go Again!

Another British data blunder: Stolen bankruptcy agency laptop had personal info.

LONDON (AP) _ The British government has admitted another data loss blunder: Its bankruptcy agency has lost a laptop carrying personal information on more than 100 former company directors.
The Insolvency Service says four laptop computers were stolen from its office in the northern English city of Manchester. It says one of them carried documents that "may give cause for concern."
The service said Wednesday that information on 122 former company directors was lost in the theft, as well as information on an unknown number of creditors, investors and employees.
Britain's government has been humbled by a series of data losses even as it attempts to roll out an ambitious national identification card. Medical, prison, and military records have been stolen or disappeared in recent months.

When will this nightmare end? One problem is that NO ONE is ever punished for putting people at risk. It's always "Oh, it was an oversight. No one is at fault."

If a bus driver in London injured or killed you because of sheer negligence they'd be prosecuted.

If bureaucrats knew they would be fined and do jail time they might remember ton keep their laptops and other sensitive data secure! IT misuse is just as dangerous as other negligence.

Here is the full miserable record of the British government.

Home Office has lost 43 laptops and 94 mobiles in three years
The Home Office has admitted losing 43 laptop computers and 94 mobile phones over the past three years, The Daily Telegraph can disclose.

By Christopher Hope, Home Affairs Editor
Last Updated: 11:39PM BST 24 Aug 2008

The news comes days after the department lost a memory stick containing the details of all 84,000 prisoners in England and Wales.

It has emerged that officials lost more than 300,000 people's details a month in the year to April.

That came on top of the loss of two CDs containing the entire child benefit database – containing the details of 25 million families – last November. The discs have still not been found.
Home Office data released in response to a question by the Tory peer Lord Hanningfield show that 43 laptops and 94 mobile phones have been lost or stolen at the department over the past three years – 15 laptops and 47 mobiles in 2007; 14 laptops and 10 mobiles in 2006; and 14 laptops and 37 mobiles in 2005.

Earlier this year, the Ministry of Defence said that almost 600 laptop computers had been stolen in the past decade.
That admission came after Des Browne, the Defence Secretary, had to make a statement to the Commons about the theft of a laptop containing the personal details of 600,000 people from a car in Birmingham.

A Home Office spokesman refused to say what was on the 43 laptops, but added: "We do not believe that any of the lost laptops contained sensitive or classified information."

Passwords Don't work!

Oh no! Once again we find that our "best practice" for security on the Net are worthless! When will all this end.

Here is the gist of the problem:

"Password-based log-ons are susceptible to being compromised in any number of ways. Consider a single threat, that posed by phishers who trick us into clicking to a site designed to mimic a legitimate one in order to harvest our log-on information. Once we’ve been suckered at one site and our password purloined, it can be tried at other sites."

"The solution urged by the experts is to abandon passwords — and to move to a fundamentally different model, one in which humans play little or no part in logging on. Instead, machines have a cryptographically encoded conversation to establish both parties’ authenticity, using digital keys that we, as users, have no need to see."

Passwords are OUT! NY Times article. NOW go ahead and read the full article.

False ID Cards - identity fabrication!

"Postville, Ia. — Federal agents who raided the Agriprocessors meatpacking plant here in May found evidence that a human resources department employee helped distribute false immigration documents to workers, court papers say.

The agents said they found about 96 fraudulent resident-alien cards in the human resources department. Many of the cards were grouped in stacks. Most of the cards, commonly known as green cards, appeared to have been made by the same forger, the court papers say.

This is a very common problem but usually company HR departments are not as blatantly involved in creating, procuring, and/or issuing false US immigration ID cards. One of the key reasons for ICE raids on companies in the United States is now ID theft. We need more information but it is likely that many of these ID cards are actually fabricated, fake identities rather than "stolen" identities.

Interesting Footnote: We have recently learned that most of the illegal workers did not even know what a Social Security Card is used for (they were asked after their arrest) and any of them cannot read or write in Spanish or English so the ID thieves and forgers were the people working for the company - the employers. But, none of them have been charged or arrested. HMM. Go figger!

Just RANTING

1.

I have been saying for months that the FTC’s “Red Flag Rule” was never intended to be all encompassing. As many of you know there has been a difference of opinion on this subject with some individuals going as far as using the rule as a scare tactic in order to profit. In my opinion, there is enough to worry about as a business owner in regards to identity theft without having such profiteers lurking about. Finally, the FTC is weighing in on this subject. I have included a recent article that addresses this issue.
http://www.consumeraffairs.com/news04/2008/07/red_flag.html

2.

Now, I am speaking to the companies that are out there offering “compliance training” and charging thousands of dollars and to the insurance agents selling identity theft services and products: Be careful and do what is right for the client.

It is only a matter of time before every adult individual in the United States will be carrying an identity theft policy/service in their portfolio. Be patient and offer the best product - not the most convenient one. The sales will come.

Remember, insurance agents make their real money in residual income. If you are seen as a partner of your client instead of seeing your client as a profit center you will realize a long term residual income and more referrals then you alone can handle. NOW go out there and do what is right.

3.

Lastly, keep in mind, “time will promote or expose”. This is very important to all of the companies coming to the market with a new identity theft product. Bring the public the best product you can and the market will reward you. If it is a product like LifeLock or ID Rehab (now Identity Watchdog) you will find out that time will expose their shortcomings. Keep in mind, indecent exposure is still illegal in most places around the world.

The consumer is not STUPID and good advertisement will not conceal the flaws of your product forever.

Politics, sex and identity theft.

Well, here is a good one! Politics, sex and identity theft. This was shared by one of our loyal blog followers. it comes from

MSNBC.com.

On July. 17, 2008 they reported that a New Jersey woman is " ... suing the call girl linked to the downfall of New York Gov. Eliot Spitzer because she says Ashley Dupre used her lost driver's license to appear on a "Girls Gone Wild" video.

Dupre, of course was the call girl in the Emperor's Club VIP prostitution ring whose client list included Spitzer.

In a federal lawsuit filed in July 2008 by Amber Arpaio who says she is the owner of the lost driver's license.

Dupre has said she was only 17 when she signed a contract to appear in the "Girls Gone Wild" video.

The video displays a New Jersey driver's license in the name of Amber Arpaio and a birth date that would have made her appear to be in her 20s.

Arpaio, 26, cannot recall where she lost the license and doesn't know Dupre, although the women have similar faces, said Arpaio's lawyer, Joseph J. Fell.

"Somehow, Ashley Dupre got ahold of the license and had it for some period of time," Fell said Thursday.

Arpaio also sued "Girls Gone Wild" founder Joseph Francis.

You can find the whole story at http://www.msnbc.msn.com/id/25727158/

Is your Internet banking safe? Take a Guess!

Read this. then go to your bank and talk to an officer about what levelm of security they have and how it works.

In most banks Internet banking is an attractive way to get customers and it saves them a ton of money in paper, printing, postage, handling. BUT, many banks and other organizations have ridiculously weak security and authentication systems.

Notice in this article how the new Internet crooks are getting information about YOU from secondary organizations like county schools which have much weaker security than the banks themselves.

Are we screwed?

Yes, pretty much because the bad guys are investing more time, energy, and urgency into figuring out how to break in than we as a society are spending. Also, federal and state politicians are largely not well versed in IT. Sen McCain who may be President has said he promises to learn how to operate a computer and will try to get his own e-mailo although he says he sees no reason to do e-mailing! YIKES!

The article "Russian Cybercrooks Target High Bank Balances Online" by Byron Acohido appeared on Wednesday, 16 July 2008, USA Today.

The piece starts, "Call them the Coreflood Gang. A ring of cyber bank robbers from southern Russia has quietly perfected a way to get a beachhead inside company networks. Once inside, it infects every PC within reach with a custom-made data-stealing program called Coreflood. The goal: go rip off bank accounts online."

This is a very disturbing development since we have often actually referred to on-line banking when we want to reassure people about the safety of Internet activities.

The article continues "Over the past 16 months, the Coreflood Gang has infected swaths of PCs inside thousands of companies, hospitals, universities and government agencies ..."

"It's spying on you, capturing your log-ons, user names, passwords, bank balances, contents of your e-mail," SecureWorks researcher Joe Stewart says. "It can capture anything."

Coreflood is part of a class of malicious software, called banking trojans, designed primarily to help crooks break into bank accounts online. The number of banking trojans detected on the Internet this month topped 24,800, up from 3,342 at the start of 2006, security firm F-Secure says.

An infection usually starts when you visit a Web page implanted with a snippet of malicious coding. By simply navigating to the tainted page, your browser gets redirected, unseen, to a hub server that downloads the data-stealing program onto your hard drive.

Dozens of gangs specialize in banking trojans. They have it much easier than phishing scammers, who must lure victims into typing sensitive data on spoofed Web pages, says F-Secure researcher Patrik Runald.

"This is very organized crime," Runald says. "These gangs are hiring people and making tons of money."

The Coreflood Gang is among the most sophisticated. Stewart recently analyzed 500 gigabytes of stolen data stored on a rented hub server. He pinpointed 378,758 Coreflood infections inside thousands of organizations, small and large.

A workplace PC can get a new infection each time someone logs on. The most infections: a county school district with 31,425, a hotel chain with 14,093 and a health care company with 6,744. About 230 networks turned up with 50 or more Coreflood infections, while 35 networks each had 500 or more.

Gang members cull the stolen data for log-ons and account statements, especially bank accounts online with high balances. Next, they log into the accounts and make online cash transfers into "drop" accounts they control.

After having two hub servers shut down by the tech security community in May, the Coreflood Gang rented two new hubs and picked up where they left off. Today, they continue operations unimpeded, says Stewart.

Companies infiltrated by the Coreflood Gang need to rethink how they do network security. Employees surfing the Internet on work PCs ought to take pause. "If you don't understand the threats that are out there, then you probably should not be banking online," Stewart says.

So this is worth a very rapid and robust response. Unfortunately these institutions are in the throes of a gut wrenching financial crisis as you well know from watching or studying the news. They therefore don't have the cash to improve security. in fact, as they downsize and slash budgets your money will be less and less safe every month.

Is this a crisis?

You decide. is the security of people's bank accounts important or not?

Call your Congressman or woman today.

Sound Off

Dr. Schmidt, Hi! My name is xxxxxxxxxxxxxxx and I'm a student in your Pol Sci 487 class. I've enjoyed the links you've sent out to news articles about identity theft across the country. It's opened my eyes, to say the least.

Anyway, I wanted to add a link to your collection - http://www.freep.com/apps/pbcs.dll/article?AID=/20080404/NEWS01/804040302

This story explores one of the 33 schools closed by administrators of the Detroit School System last year. The school was left unlocked with what appeared to be all of its contents inside - including student records free for the taking. In fact, the Detroit Free Press reporter returned some special education records to the families of students, not the school district.

Contractors were paid to pack the items inside all schools and secure its contents, which appears to have never happened. The school district feels it may be cheaper to demolish these buildings instead of repair the abuse.

I was really disgusted to read this - I hate that even our youngest citizens can fall prey to identity theft due to the incompetence of adults.

Thank you for giving me a forum to sound off. I've enjoyed the course.

British Identity - It's mostly LOST!

Americans feel stressed about the safety of their identities.

It's a good thing they are not British!

Here is some of what David Harrison of The Telegraph reported. "A record 37 million items of personal data went missing [in 2007].

Most of the data was lost by government officials but councils, NHS trusts, banks, insurance companies and chain stores also mislaid or published personal information about staff or members of the public. Many losses were caused through CDs going missing in the post, laptop thefts, and inadequate security systems that failed to stop hackers reading information stored on computers."

The details lost included those of names, addresses, passports, bank and mortgage accounts, credit cards, hospital records, dates of birth, national insurance numbers, driving licences and telephone numbers."

Well, that pretty much takes care of every scrap of information someone needs to totally screw over any citizen!

"The "shocking" total of 36,989,300 items prompted calls for the Government to kill its plans for national identity cards.

Nick Clegg, the leader of the Liberal Democrats, who produced the figures, said: "The ID card project is now in freefall, because faith in the Government's ability to handle personal data has hit crisis point - 2007 was the worst ever year for personal privacy. We need a total rethink on data protection enforcement and an immediate end to the identity cards plan."

This really answers the question of why a National ID Card is good in theory but very bad when you understand that government bureaucrats don't give a damn about your security and privacy. How many government employees are doing jail time for putting at risk the security, happiness, and tranquility of citizens? The answer is that I personally have NEVER seen a single story (unless someone actually STOLE this data).

"The biggest single loss was in November when Alistair Darling, the Chancellor, revealed two CDs with personal details of 25 million child benefit claimants and their parents had gone missing."

Yeah and I saw somewhere that this amounts to 40% of all Briots! That's what you get for sucking up so much government welfare!

"Three weeks ago Ruth Kelly, the Transport Secretary, admitted that the details of three million learner drivers had gone missing when a hard drive was lost in Iowa, USA.

Last February it emerged 80 passports are lost in the post every month."

Oh good! And how does this help protect the world against terrorists using illegal British passports?!

Last month, CDs with personal information on thousands of benefit claimants were found at the home of a former contractor to the Department of Work and Pensions.

Three days later the names, dates of birth and national insurance numbers of 45,000 people claiming benefits in west Yorkshire were lost by the Government.

A spokesman for the Home Office said the National Identity Register will not hold tax, benefit or other financial records. "We will draw on any lessons learned from incidents of data loss.The whole scheme will be fully security-accredited."

Stay tuned because the risks to your safety and security are getting greater and greater even if you do not live in England!

The archeological deposit of trillions of data rats

Here we go again! The use of Social Security numbers for every random, routine activity has left an archeological deposit of trillions of data rats nests scattered all over the landscape of the United States.

Until a few years ago professors at a major US University reported that they had to fill out a new form every semester with all their info INCLUDING SOCIAL SECURITY NUMBER to obtain an activated key so they could access the multimedia cabinet in their classrooms. Most of these forms were faxed top the office where this was done and were stuck in cabinet somewhere.

The announcement of the data breach below follows the industry standard phrase “We want to assure you that there is no evidence that the computer intruder accessed the files containing Social Security numbers.” Usually the lawyers also add “There is no evidence that any of the information has been used in any identity thefts.”

All we can say is “Yeah, right!”

Here is the latest case study for you to study.

DATE: Dec. 11, 2007

TO WHOM? Iowa State University Faculty and Staff:

WHAT? “A security breach recently was discovered on a server in the Office of
Sponsored Programs Administration. Old files found on that server contained the names and Social Security numbers of approximately 2,900 faculty and staff who submitted proposals through the OSPA GoldSheet process prior to Jan. 1, 2006.

“We want to assure you that there's no evidence that the computer intruder accessed the files containing Social Security numbers. Our technical experts believe the primary motive was to store movies and hacker-related software.”

Two servers at OSPA were breached by the intruder, but only one computer contained files with Social Security numbers. The security breach was reported to Information Technology Services staff on Monday, Nov. 26. The server had already been removed from the campus network. A thorough examination of the server over several days yielded files containing names and SSNs.

Over the past couple of years, Social Security numbers have been removed from all central systems and business processes, except where the SSN is required. This incident points to the urgency to inspect old files and remove Social Security numbers that once were a routine part of university reports. If you need assistance in finding protected information on your computer or would like to know more about securing your computer, please contact …………., ITS security.

We regret any inconvenience or distress this security breach may cause.
We do not think it is likely your information was accessed, but if you are concerned, please see the resources below.

If you have concerns or comments on this security incident, please feel
free to contact either of us.
Michael McCoy @ insurancenow@hotmail.com
Dr. Steffen Schmidt @ steffenschmidt2005@gmail.com

ADDITIONAL RESOURCES:

What should I do if I am concerned about possible identity theft?

1. Place a fraud alert on your credit report. This tells creditors to contact you before opening any new accounts or making changes to current accounts. The Federal Trade Commission offers more information on how to place a fraud alert at http://consumer.gov/idtheft

2. Get a copy of your credit report from the three major credit bureaus
(Equifax, Experian, and TransUnion) and make sure all accounts on that report belong to you. You're entitled to a free annual credit report from the three major credit bureaus. See: https://www.annualcreditreport.com/

26 Years of Non Public Information Shared by U.S.D.A.

Apparently individuals that applied for federal grants through the USDA didn’t read the fine print. It was not explained to them that their names and Social Security numbers (non-public information) were going to be shared with the world.

Below was a statement by the USDA -

“USDA believes that immediately prior to April 13th, the website in question contained private identification information relating to approximately 47,000 individuals who receive USDA funding from the Farm Service Agency and USDA Rural Development. USDA has identified between 105,000 and 150,000 individuals whose private information has been entered into a federal government database at some time during the past 26 years. USDA is in the process of notifying, via registered mail, all 150,000 people whose information was exposed and offering them the opportunity to register for free credit monitoring for one year.”

Once again one of our trusty government agencies gives us an identity theft headline. I guess maybe I should not complain, it does give me job security.

Are You At Risk?

Is anyone’s identity really safe these days? There are two big issues that identity theft educators, investigators, and law makers are trying to convey. One is the risk of business identity theft and its ramifications to businesses (of all sizes) and the other is the risk to individuals. Of course, there is overlap with both, because one affects the other. Right now, I want to focus on the personal side of identity theft—your personal risk. The big question is. . . Are you at risk? The answer is absolutely YES!

According to Privacy Rights Clearinghouse, a non-profit consumer information and advocacy organization, security breaches of personal identifying information are accelerating and putting all Americans at HIGH risk for identity theft. Over 104 million data records have been breached in the past two years. Visit www.privacyrights.org to see the National Data Breach List. I have noted this before, but since the total is increasing so fast, you really must see why for yourself.

Types of Identity Theft
Are you aware that there are 5 types of identity theft? Most people are not aware of this fact. Financial identity theft may be the most common, but it is about 28 percent of all identity theft. In the United States, driver’s license, medical, Social Security, and criminal identity theft are just as serious, especially to their victims. Did you know that 12 percent of all identity theft victims end up with a wrongful criminal record?

Think about it. You could be arrested during a routine traffic stop for crimes you did not commit. A thief could use your SS# for employment and you become responsible for paying the taxes on that income. Your medical insurance rates could go up or your health insurance coverage could be cancelled or used up. Unfortunately, in all areas of identity theft, innocent victims are considered guilty until proven innocent. In addition, laws hold victims partially responsible for fraudulent debt after 48 hours, and hold them fully responsible if not reported within 60 days.

The Federal Trade Commission (FTC) says, “People whose identities have been stolen can spend months or years—and thousands of dollars—cleaning up the mess the thieves have made of a good name and credit record.”

Laws Protect Consumers
New federal privacy and identity theft laws protect the consumer. These laws are putting the responsibility on all businesses to protect personal identifying information that is maintained, stored, or discarded.

Consumers are not yet aware that if any size or type of business is in violation of a data security breach resulting in identity theft, then the victims may likely win a class action lawsuit. Some law firms around the country are advertising to represent identity theft victims. Victims of winning cases can be awarded damages with no statutory limitation, including payment of actual losses and attorney fees. Hefty penalty fines can be assessed to the business and executives. And, prison terms for executives may be enforced, depending on which privacy laws were violated.

Based on existing federal and state laws, consumers have the right and power to blow the whistle on businesses not compliant to federal/state security regulations. Some states give a whistleblower reward up to 15 percent of the fines collected. (More on this at a later date.)

The ultimate power consumers have is to stop doing business with privacy and security offenders who are negligent and disrespectful of safekeeping personal identifying information about their customers and employees.

The Reality
The worldwide reality is--identity theft cannot be prevented. It is out of the individual’s control how others use and store personal identifying information. However, increasing your awareness and adopting safe habits at home, in public, and at work will help to lower your risk.

The Best Wall of Defense
The strongest defense for identity theft includes a credit report, daily credit monitoring, and true restoration of your identity (restoration of all 5 of them), plus more. It is a defense system that clicks in immediately when the unexpected happens. I know of only one company that performs all three of these services.

Be Proactive, Not Reactive
The risk is very high for all forms of identity theft and will continue to increase. People need to take protective measures, understand the threats, and not ignore the warning signs. While identity theft emerges as the immensely destructive villain that it is, its wrath is devastating victims and its path is forcing change to lifestyle habits and business practices.


Lois Hale, MS, CITRMS Reno, Nevada USA
ICFE Certified Identity Theft Risk Management Specialist
ADRS Certified Group Security Specialist