Does ID Theft Weigh-In On Immigration Debate?

by Sue B. Martines J.D. and Michael McCoy M.Sc.

“It’s a black and white issue,” the gal next to me on the plane volunteers, as she peers over at the newspaper article I’m reading about Arizona’s latest immigration law battle. And then it taints my entire train of thought -- is it as simple as that? Is it as simple as saying someone is either lawfully in this country or they’re not? Is it that you either jumped through the justice hoops and got it done or you need to go back from whence you came?

Foregoing the more esoteric consideration, perhaps, about whether borders are indeed a necessity, when identity theft is factored into the immigration debate, how can it ever be black and white? The July 16, 2010 USA Today article discusses how immigration is re-entering the national debate and is back in the spotlight for November’s races. But nowhere is identity theft addressed in the article.

And yet, there are dozens of websites where anyone with $20 and a credit card can buy a fake ID. You gotta wonder upon what document is the “sending one back from whence they came” based?

If an illegal immigrant turns into an identity thief by buying a Social Security number in order to remain in the U.S., and it’s happening at an alarming rate, then is there an additional argument in favor of such laws being looked at in Arizona – where immigration is reviewed with nearly every bust?

A Center for Immigration Studies article cites that approximately 75 percent of working-age illegal aliens use fraudulent Social Security cards to obtain employment. (And that was in 2009.)

Understandably, regardless of which end of the potentially black and white immigration spectrum one stands, there cannot be a laundry list of potential crimes to be evaluated with every charge, but identity theft needs to be factored into the mix somehow. In fact, if identity theft doesn’t weigh-in now, the immigration issues we’re facing may never really get addressed.

Where’s the Crime in ID Theft?

by Sue Martines J.D. and Michael McCoy M.Sc.

Doesn’t its very name, identity ‘THEFT’ beg for its categorization as a “crime??” And isn’t thieving arguably the quintessential global crime throughout the ages? Our children play at being burglars, and video games , Hollywood, comics and authors profit from images of the classic “bad guy.” It’s just that those images aren’t historically of the stealthy computer whiz in his home abroad bartering online for our health insurance policy data so that it can be re-sold for tens of thousands of dollars!!

Unlike more traditional “theft,” identity theft has a business overlay that often overshadows the criminal nature of the crime!

In a non-empirical study of all news reports in the US on identity theft in the past 30 days, it appears that approximately 47% of all reported newsworthy identity theft stories relate to criminal cases. (See Google’s daily “identity theft” global search).

In other words, instead of just stories relating to how to travel this summer without identity theft risks (see http://www.thesilentcrime.com/) or how to be ready to avoid identity theft when placing a catalogue order, per Heloise (see http://www.chron.com/disp/story.mpl/life/dailycols/7063108.html), or The Chicago Tribune telling you to shred your bills to prevent identity theft (see http://www.chron.com/disp/story.mpl/life/dailycols/7063108.html) -- I’m talking about the stories on the two arrested in Maricopa, Arizona for using a stolen credit card at a local drug store (see http://www.abc15.com/dpp/news/region_central_southern_az/maricopa/2-arrested-in-maricopa-identity-theft-case) or The Washington Post story on the security guard now charged with identity theft! (See http://voices.washingtonpost.com/local-breaking-news/crime-and-public-safety/georgetown-guard-charged-with.html.)

Why is it that the juicy stories about crime victims get usurped by the perhaps more mundane shred your receipt ones? And that the burden of the impact of identity theft seems to fall shamelessly upon the victims, consumers and businesses??

In fact, the business overlay is so bold with identity theft that the ever-evolving laws relating to it go more to the duties of business owners than to the culprit! (See the FTC’s Red Flags Rule as one example, requiring targeted businesses to have mitigation plans for identity theft.) Don’t get me wrong, this writer is not advocating for stricter criminal penalties, or some kind of high mandatory minimum sentence for the villainous identity thieves, or even that we should buy a lock and live in a cage – it’s just that current events bear observing.

Perhaps more creative measures are required to nab this newfangled thief. Who knows, maybe smart offensive strategies on the part of consumers and businesses will ultimately even offset the growth of identity theft!

Maybe it’s Pollyanna of me, but I can envision a video strategy game where the chivalrous prince outwits the cunning identity thief’s attempt to invade the castle via the king’s identity… and not just by buying Lifelock.

Follow Michael McCoy at www.twitter.com/mccoynews

Red Flags Or No Red Flags, Businesses Need To Act

The FTC may imply that part of the latest Red Flags enforcement delay is to await clarification which pending legislation may bring, but the reality is that the legislation is purely an appropriation consideration not an appropriateness one! In other words – for the pending legislation to consider whether or not certain potential indicators of data fraud in the workplace ought to require attention or not begs the question. Of course they should! The real issue is whether the needed attention can be afforded.
According to the Privacy Rights Clearinghouse’s infamous “chronology of data breaches,” over 300 million data breaches have taken place between April 20, 2005 (the date it began tracking breaches) and the time of this writing. www.privacyrights.org Assuredly, if any of the victims of those millions of data breaches were asked if their data was less worthy of protecting than others the answer would be NO!
The Red Flags Rule, as it’s commonly known, is designed to ensure that entities that extend credit detect, prevent and reduce cases of identity theft under penalty of fines. http://www2.timesdispatch.com/rtd/business/local/article/B-FLAG29_20100528-221006/347604/
Originally passed in 2008, the FTC just announced that enforcement of its Red Flags Rule is yet again delayed – this time allowing compliance through December 31, 2010. http://tampabay.bizjournals.com/tampabay/stories/2010/06/07/story7.html
The pending legislation will determine if it ought to extend to workplaces with fewer than 20 employees, but common sense would tell us that protection from identity theft ought to be extended to all. If common sense dictates that, then, Red Flags or no Red Flags, all businesses ought to do everything they can to protect data on their own – for even if applicability is decided, monies to assist may or may not be attached. http://www.ftc.gov/bcp/edu/microsites/redflagsrule/RedFlags_forLowRiskBusinesses.pdf

By Sue B Martines, J.D.

Book Review Preview – “Cyber War,” by Richard A. Clarke and Robert K. Knape, 2010

Written by two gentlemen from intentionally disparate generations – a tricenarian (someone in their 30’s) and a sexagenarian (someone in their 60’s), as though modeling for us the evolution from a relatively theoretical threat to a very real one, unpeel not only the chronological journey but also the practical impact of a modern day cyber war. Imagine your city’s system of traffic signals being out of sync due to lengthy blackouts, or your financial records being rearranged or pipe system exploding??
Yes, indeed, this would be a different kind of war. Authors Clarke and Knape posit that US civilians have one of the greatest chances of high impact in such a cyber war, and in fact, that countries are already positioning themselves for battle. And these writers should know – Clarke served as a counterterrorism advisor to both Presidents Bill Clinton and George W. Bush, and Knape won a prestigious Fellowship at the Council on Foreign Relations to study cyber war.
Our own Pentagon, the authors recap, admit to thousands of “pings” a day upon their computer armor – probes from foreign computers seeking to penetrate where weaknesses may lie. And on occasion, they succeed – fighter planes not yet in the air have had their details hacked into. And our nation’s very own computer supply chain is global and not necessarily trustworthy they point out… (for example, even while you’re reading this article, your computer could be “drafted” into a cyber war against a foreign bank, without your even being aware).
Some solutions are presented that may benefit readers – for instance, if you’re going to make purchases online, use a card with a low limit used solely for that purpose, they suggest; use your work computer at work, and your home computer at home; and make sure your online bank uses more than just a password for its security protection. But how would one protect from the story outlined in Cyber War?
Their book describes a supposedly hypothetical scenario where hackers incapacitate the US from behind their computer screens. In an NPR “Fresh Air” interview, author Clarke admits he cannot explain why such a hypothetical situation hasn’t already come to pass . Couple that fact with the point that the government is predominantly focused on protecting our nation’s defense capabilities… This writer can’t help but reminisce upon the Y2K preparations and wonder about the value of their revival…
Reviewing, Cyber War: The Next Threat To National Security And What To Do About It, Copyright 2010, by Richard A. Clarke and Robert K. Knape, published by Harper Collins, and as reviewed on NPR.org.
Sue B Martines, J.D.

Sleuthing Your Own Employees

Are you sure your very own employees are not divulging non-public information on social networking sites such as Facebook, Twitter, MySpace or LinkedIn? There are certainly potential issues relating to the appropriateness of social networking while on-the-job (addressed in an earlier article on this blog), but more and more employers have a presence on these trendy sites and in many instances, encourage it. However, there may need to be protections for your business from your very own employees according to a Blogger News Network, April 6, 2010 article on the topic. (http://www.bloggernews.net/124226)
Really -- who needs thieves, when our own employees can be duped by users of crafty social networking sites to share logins and passwords to our company network. The above-referenced article describes one test of such a fact pattern which found nearly half of all the employees tested fell for the demands of a well-crafted, illegitimate duplicate site of their employer’s.
It’s nevertheless hard to put too much blame on the vulnerable employees – the duplicate site looked like very credible outreach from their HR department. And a recent Time Magazine article reported 70% of US HR officers reported utilizing social networking sites to screen employees. (“Social Networking Sites Can Lead to Legal Pitfalls,” http://www.bizjournals.com/dayton/stories/2010/04/05/focus3.html?b=1270440000^3132331) This begs the point that internal policies for any workplace can only help give guidance in this situation.
Because we can’t expect the social networking sites to do our sleuthing for us! As the Blogger News Network story suggests, employers ought best appoint a site administrator to oversee work-related online employee interfacing for the time being. And the best legal defense remains the best offensive strategy and taking extra measures to protect access to company websites and having a corporate policy/training on the topic just makes sense.
Sue B Martines, J.D.

Educate Girls and Reduce ID Theft Risk

Arguably , if you better educate anyone about risk, you reduce the potential harm. So why focus on girls? Pick the highest risk group, and generate exponentially greater potential payoff is why. One recent study found women to be 26 percent more likely to be victims of identity theft and fraud than men. (Javelin Strategy & Research’s, 2009 Identity Fraud Survey Report, http://www.mybackgroundcheck.com/blog/post/2009/02/Why-Women-Suffer-More-Identity-Theft-and-Fraud-than-Men.aspx.)
That same study attributes the results to women making purchases more frequently “in-person,” as opposed to online, than men, and to their being three times more likely to report being a victim than men!
In Greg Mortenson’s book Stones Into Schools (the sequel to #1 bestseller Three Cups of Tea), wherein it’s undertaken to build schools for girls in outlying parts of Afghanistan and Pakistan, it’s noted that the education of girls leads to increased income for not only the girls themselves but for their entire nation.
Knowing how identity theft can lead to losing the next most valuable asset after one’s health, it’s really not that far of a cry to see that focusing on girls’ education can not only improve basics like income level and health, but the ability to keep what is so hard gotten, like one’s identiy. Identity theft need not disproportionately impact women in any part of the globe when education can be a potential cure.
Sue B Martines, J.D.

Social Networking and Some Employment Law Snafus (Part I)

Imagine yourself the Human Resource Specialist for a large employer – as the arena of social networking explodes, you are faced with a series of issues that were never even considered before the days of internet insanity. Let’s try out a handful of these situations, and see how you would fare –
1. One of your employees is found to have posted their photo, complete in company logo shirt, on Facebook.

Does it matter that it’s a personal site? How ‘bout that the logo is represented in the photo?

The outcome might be to consider prohibiting the display of a company logo, or product, etc., on even an employees’ personal site. (Keeping in mind that certain businesses may want to have their logos or products given higher exposure.)

2. What if the employee’s photo is of themselves at work in a skimpy bikini?

Certain websites have privacy abilities where such photos may not even be seen, however, coworkers often bring to your attention items that even the employee themselves may not realize is visible. Can someone’s behavior after work hours be monitored? How does such monitoring balance with freedom of speech protections?

In reality, a situation like this is probably best handled in consultation one-on-one with the involved employee. The best case scenario would be the employee didn’t realize the photo was publicly visible and agrees to remove it. However, another outcome might be to consider prohibiting the posting of photos of work area, or on-duty activities. (For certain companies there is a security justification for such posting prohibition.)

3. What if employees take a pay cut because business is down, and then photos are posted by the boss’ wife on Facebook?

And then the employees start circulating a union petition…and demand a raise?? Isn’t there some similarities to the boss driving up to work in a new car?

At its heart, this is all about perception. If workplace executives or managers are counseled on the business impact of personal posts, along with the encouragement of using privacy settings, it should help. Also, it can’t hurt to increase your transparency, so to speak, of business finances. (And possibly gear up for a union election campaign at the same time!)

We want to hear from you – send your social networking and employment law snafu situations to us this week at suebmartines@gmail.com, and stay-tuned for Part II!

CPA’s, Identity Theft, and the Law

By: Sue B Martines J.D.

The attorneys may have gotten off the hook for the Red Flags Rule requirements, but so far, not the CPA’s, among other “professionals” (such as physicians). Picture this – two so-called “professionals,” one an attorney and one a CPA, discuss identity theft and the Red Flags Rule implemented by the FTC to help businesses develop “Red Flag” indicators for fraud – the conversation might go something like this:

Attorney, “being a busy professional, I sure am grateful to not have another burdensome requirement made of me by the government!”

CPA, “being a busy professional, I sure am grateful for the opportunity to have guidance on how to better guard against the time-consuming, professionally-damaging and high client impact of an identity theft or data breach!”

Two different professionals, two different treatments so far, by the law!

In a previous posting, we discussed the recent court decision finding attorneys exempt from the “burdensome” requirements of the Red Flags Rule; here we make the somewhat absurd double-standard comparison, you might say, to one of their counterparts -- CPA’s.

We all know there’s no immunity from identity theft risk. The American Institute of CPA’s itself fell prey to the #1 risk factor – human error – when in 2006 a damaged hard drive containing personal information was sent out for repair and was lost in transport. (http://www.pro2net.com/x52999.xml)

However, in an IRS online publication regarding CPA’s and identity theft, you will find zero things unique to the CPA that wouldn’t equally apply to an attorney! (http://www.irs.gov/pub/irs-utl/identity_theft_what_cpas_need_to_know.pdf)

Certainly the fight may not be over for CPA’s, or other “busy professionals” whose attorneys will challenge the Red Flags Rule “requirements” to have an identity theft prevention and mitigation plan in place by June 1, 2010.

Yet, if only all CPA’s could look at identity theft and data protection measures like the one in the discussion above – it could mean less lawsuits for the “burdened” attorneys, and better protection of client data!

Maybe the requirements of the law aren’t that bad of an idea after all!

Sue B Martines is a recovering attorney of 12 years now living in Oregon. Sue can be reached at, suebmartines@gmail.com

THE MANY USES OF SOCIAL NETWORKING

THE MANY USES OF SOCIAL NETWORKING
Michael McCoy and Sue Martines J.D.

It’s always been said that a jury of one’s peers will generate the most authentic outcome, although some would say, the most severe. Honesty can hurt. Just ask the manager of a 70-year-old supermarket chain who got fired, or at the least transferred, over refusing to exchange a $4 watermelon.

One disgruntled customer taking the real story to the social network of Twitter, Facebook, and other online resources, and the wheels of justice begin to really get rolling. Ask a friend, a neighbor, or colleague, how it would feel to have their spouse humiliated over a $4 purchase from a merchant who prides themselves on “customer convenience,” and they’ll tell you they’ll stop shopping there. But previously the buck would stop there.

Enter social networking. Now, with a brief description of your experience, and a request for action to your “network,” and the emails and calls to the store start flooding in. What retailer in their right mind is going to ignore an outpouring of negative responses from the very customer base it claims to hold dear?! And in a market where your existing customers are ever-more valuable.

This retailer didn’t ignore it. The customer’s been advised that neither he, nor the rest of the “network” will ever have to deal with that manager again. Click, type, action – results. The following quote is the response from the store director after a week long social networking campaign:

“I am not able to discuss details, just that you will not have to deal with the manager that caused you and your wife the problem. As I said before, we take customer service issues very seriously, and I hope to see you and your family back at XXXXX soon.”
Thanks,
Store Director

It’s not a stretch to wonder, when it comes to social networking, what’s next – influence global politics? Reunite estranged families? Shift the buying habits of a nation? On some of these perhaps, the jury is still out, but for this particular store manager, the verdict was clear. Guilty by a jury of his peers.

Michael McCoy can be followed at, www.twitter.com/mccoynews