Why Keep Personal Information On A Laptop, When It's Much Easier To Steal On A CD?

from the good-work,-idiot dept

In story after story about data leaks stemming from a lost or stolen laptop, one question that’s never answered very well is why people are carrying so much personal information on portable devices anyway. But why bother with the inconvenience of a laptop, when you could just put the social security numbers and other information of 75,000 of your customers on a CD without any encryption and make things so much easier for would-be identity thieves? That’s what a boneheaded subcontractor for a health insurance company did, and now — surprise, surprise — the disc has gone missing. The insurance company is making the standard offer of a year of credit monitoring to those whose information was on the CD, but since the offending party didn’t work directly for it, rather for another contractor, it sounds as if it won’t be able to take any action against the subcontractor. So, it sounds like nothing’s changing, and companies are remaining careless with personal information because there’s no reason for them to protect it.


Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Why Keep Personal Information On A Laptop, When It's Much Easier To Steal On A CD?”

Subscribe: RSS Leave a comment
20 Comments
ThDock22 says:

Smart Thieves...

Smart identity thieves would just wait a year before actually selling or using any of the information they got. Thanks for nothing you careless company.

You would think the legislation would quit passing stupid laws, like banning MP3 players while walking around, and make some laws that actually are enforceable and have an effect, like requiring all sensitive/personal information stored on any kind of device to have GOOD/effective encryption strategies. I guess it is too much to ask we have some smart legislators though…

Then again, maybe the CD fell behind one of the desks. I sure know I’ve found many of mine back there.

Anonymous Coward says:

Re: Smart Thieves...

Smart identity thieves would just wait a year before actually selling or using any of the information they got. Thanks for nothing you careless company.

You would think the legislation would quit passing stupid laws, like banning MP3 players while walking around, and make some laws that actually are enforceable and have an effect, like requiring all sensitive/personal information stored on any kind of device to have GOOD/effective encryption strategies. I guess it is too much to ask we have some smart legislators though…

Then again, maybe the CD fell behind one of the desks. I sure know I’ve found many of mine back there.

First of all, how would you write a law like that if you were a politician? Do you specify a particular encryption level? Does it apply to every piece of data that can be linked to a person? Wouldn’t that effectively give the government the right to come in and look at any data a company has, without a warrant or other legal notice, in the name of making sure this new hypothetical encryption law is being followed?

As a side note, the insurance industry already has rules regarding data protection that they can be fined against in this instance, it’s called HIPAA.

TheDock22 says:

Re: Re: Smart Thieves...

First of all, how would you write a law like that if you were a politician?

With small, easy words the other politicians could understand.

Do you specify a particular encryption level? Does it apply to every piece of data that can be linked to a person?

I suppose you would have to specify an encryption level, and I say any data an identity thief could use, like your birth-date and social security number. Name and address aren’t really that important as far as stealing someone’s identity.

Wouldn’t that effectively give the government the right to come in and look at any data a company has, without a warrant or other legal notice, in the name of making sure this new hypothetical encryption law is being followed?

Well now that’s just plain silly. Of course the government would have to have a warrant if they suspected a company was not upholding the encryption law. I mean, the cops can’t bust down your door without a warrant for your computer (assuming they do not expect someone is about to be hurt inside your residence and even then they can only get the other person out and not collect any evidence).

Betaflame says:

There is one reason...

“because there’s no reason for them to protect it.”

While there may be no legal reason for protecting it, companies who lose customer data like this are penalised. Not by the gov’t but by the customers. If a customer doesn’t feel safe with you having there info they will not remain with that company. It has happened in the past, and I know of a few major companies who look at keeping customer data safe as a top priority. Banks have known this for year, I’m surprised other companies are taking so long to realise data leaks = bad thing.

UCLA Sucks says:

UCLA is one of the nation’s leaders in losing people’s information. They are never held liable for their information leaks, which is probably why it happens over and over.

Not only that, but UCLA is a school. Because it is a school, it has the right to use means that are illegal for commercial companys to track you down and to sell your information. The law states that you must contact UCLA and ask them not to sell your information, or they may do it.

I hate that UCLA tracks me down wherever I move within about 1 month. I hate that they hold onto my information. I hate that their data gets compromised so often.

These companies, and non profit institutions should be held fully accountable for these information leaks due to negligence.

ehrichweiss says:

HIPAA

As someone already pointed out, this falls under HIPAA and they can be fined BIG TIME. I know of a “network administrator” *cough cough* who setup a piss poor router for a medical billing company and he claimed to know about HIPAA. A year later they discovered the idiot left a major hole open and that data had possibly been compromised and my friend, who had warned him about all of this being a possibility, testified as an expert witness against him.

No wonder I lie about my SSN, etc. these days. I’m sure someone else will collect my benefits but I don’t really pay into social security anyway so what are they gonna get an extra $4/month?!!?

TheDock22 says:

Re: HIPAA

HIPAA is the Health Insurance Portability and Accountability Act, so it only applies to Medical/Health companies.

What about credit card companies and such? What happens when the FBI screws up? Nothing.

Also, the company that lost the information was a subsidiary company under a Health insurance company. I’m not sure they can legally be fined using HIPPA, those rules apply to 1st party companies as far as I know.

Tyshaun says:

Re: Re: HIPAA

HIPAA is the Health Insurance Portability and Accountability Act, so it only applies to Medical/Health companies.

What about credit card companies and such? What happens when the FBI screws up? Nothing.

Also, the company that lost the information was a subsidiary company under a Health insurance company. I’m not sure they can legally be fined using HIPPA, those rules apply to 1st party companies as far as I know.

HIPAA was written in such a way as to create a “chain of custody” for your information. Basically any recipient or handler of information that was acquired under HIPAA must be HIPAA compliant.

Tyshaun says:

Re: Re: HIPAA

The only reason HIPAA applies is that this particular instance was about an insurance company. No, it does not apply to credit card companies, and in fact, a lot of CC companies write the fine print of their contracts such that you authorize them to distribute your information as they please (for instance, report your credit status to the credit bureaus). Given that fact, I’m not even sure a law written to penalize the situation described would even work for a company where you sign an authorization for them to distribute your information.

Phibian says:

Benefit of the doubt

Should note that it isn’t clear that the disk has actually been stolen. Although still a boneheaded thing to do, the fact is that the CD *could* have simply been misplaced (and I’ve seen important papers, CDs and even equipment go missing all the time and it has always been disorganization or carelessness that is the problem rather than thieves)

Burned CDs are not the most reliable way to transfer information anyway. Even if stolen, assuming the burned CD contents will still be legible on the CD a year from now is a bit of a stretch – all they have to do is actually leave it out on a sunny desk somewhere and poof – the data is gone.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...
Loading...