The Hindu Business Line : Common man's data in compromised state

JOHN Perry Barlow said, "Relying on the government to protect your privacy is like asking a peeping tom to install your window blinds." But that may need revision, because it's not only the government but also the big companies and banks that are helplessly watching identity thefts happen.

For instance, a few days ago, LexisNexis, a leading player in the legal and business information field, conceded that data of more than 3 lakh people held by the company's subsidiary might have been fraudulently accessed by criminals; original estimate was only 30,000, reports www.out-law.com.

"HSBC North America is advising 1,80,000 holders of its General Motors branded MasterCards that they should cancel their cards and request replacements because their transaction data has been compromised," is from a report on www.theregister.co.uk, datelined April 15. The story also speaks of `massive breaches' within the past eight weeks at other organisations such as: ChoicePoint, PayMaxx, Bank of America, San Jose Medical Group, and DSW.

As if that were not enough, Tufts University has warned its more than a lakh ex-students after it found that `a database of alumni donors has been compromised'. Similar incidents have hit California State University, and the University of California, Berkeley. The latest in the list of id thefts is the one that targets the newly-weds. "The unwitting couple receives a letter saying they are required to register their name change with the federal government. They are asked to supply a wealth of personal information - address, birth date, even Social Security number. A fee of $15 to $20 is needed, payable by check or credit card," notes a story on www.delawareonline.com dated April 17.

"In the course of a busy day, you may write a check at the grocery store, charge tickets to a ball game, rent a car, mail your tax returns, change service providers for your cell phone, or apply for a credit card. Chances are you don't give these everyday transactions a second thought. But an identity thief does," is a terrifying para with which the new brochure for consumers on www.ftc.gov begins. It is titled, `Take Charge: Fighting Back Against Identity Theft', known formerly as, `ID Theft: When Bad Things Happen to Your Good Name'. There's the URL to help: www.consumer.gov/idtheft, with the government coming to the rescue of the consumer.

How far is the State doing its job? As if to answer, an April 2005 report of the US Government Accountability Office (GAO) is ominously headlined, "Internal Revenue Service Needs to Remedy Serious Weaknesses over Taxpayer and Bank Secrecy Act Data." Of the 53 weaknesses that the GAO had identified in its earlier review, the IRS has corrected 32. That is good progress; however, to the remaining 21 weaknesses, the GAO has added 39 `newly identified information security control weaknesses' that impact "the IRS's ability to ensure the confidentiality, integrity, and availability of its sensitive financial and taxpayer data and FinCEN's Bank Secrecy Act data."

GAO's conclusion is categorical: "IRS has not consistently implemented effective electronic access controls, including user accounts and passwords, access rights and permissions, and network security, or fully implemented a program to audit and monitor access activity." Wish the C&AG did a similar exercise here. For, identity theft is a legitimate worry for us too, even as the Finance Minister is eager to establish an audit trail by letting banks insist on further disclosures from customers. One wonders if our taxman has adequate controls to ensure the safety of taxpayers' data.

Meanwhile, there's a dangerous development in our IT space. "Fraud Case Focuses Unwelcome Attention on Indian Outsourcing," reads the title of a report on www.gartner.com dated April 14. It begins thus: "On April 13, MphasiS confirmed to Gartner that 10 people — including four former and one current employee of its BPO unit, MsourcE — had been arrested in India for allegedly misappropriating more than $350,000 from customers of a large US financial institution. The misappropriation allegedly occurred when customers of the financial institution, which outsources certain customer care processes to MsourcE, were inappropriately persuaded to share their passwords over the telephone." The crime is predictably a hot topic in cyberspace, especially because it stirs up again the is-it-safe-to-outsource-to-India question.

"Too many women throw themselves into romance because they're afraid of being single, then start making compromises and losing their identity. I won't do that," declared Julie Delpy. But, as things go, to lose identity, you don't need to be a weak woman, as Julie feared.

E&OE@TheHindu.co.in

Article E-Mail :: Comment :: Syndication :: Printer Friendly Page

Stories in this Section
Ocwen targets mid-sized cos with call centre solution

Common man's data in compromised state

TRAI orders VSNL to give bandwidth to all ISPs — Objections to 'outside routers' on security ground overruled

Looking back