Why Keep Personal Information On A Laptop, When It's Much Easier To Steal On A CD?
from the good-work,-idiot dept
In story after story about data leaks stemming from a lost or stolen laptop, one question that’s never answered very well is why people are carrying so much personal information on portable devices anyway. But why bother with the inconvenience of a laptop, when you could just put the social security numbers and other information of 75,000 of your customers on a CD without any encryption and make things so much easier for would-be identity thieves? That’s what a boneheaded subcontractor for a health insurance company did, and now — surprise, surprise — the disc has gone missing. The insurance company is making the standard offer of a year of credit monitoring to those whose information was on the CD, but since the offending party didn’t work directly for it, rather for another contractor, it sounds as if it won’t be able to take any action against the subcontractor. So, it sounds like nothing’s changing, and companies are remaining careless with personal information because there’s no reason for them to protect it.
Comments on “Why Keep Personal Information On A Laptop, When It's Much Easier To Steal On A CD?”
Smart Thieves...
Smart identity thieves would just wait a year before actually selling or using any of the information they got. Thanks for nothing you careless company.
You would think the legislation would quit passing stupid laws, like banning MP3 players while walking around, and make some laws that actually are enforceable and have an effect, like requiring all sensitive/personal information stored on any kind of device to have GOOD/effective encryption strategies. I guess it is too much to ask we have some smart legislators though…
Then again, maybe the CD fell behind one of the desks. I sure know I’ve found many of mine back there.
Re: Smart Thieves...
First of all, how would you write a law like that if you were a politician? Do you specify a particular encryption level? Does it apply to every piece of data that can be linked to a person? Wouldn’t that effectively give the government the right to come in and look at any data a company has, without a warrant or other legal notice, in the name of making sure this new hypothetical encryption law is being followed?
As a side note, the insurance industry already has rules regarding data protection that they can be fined against in this instance, it’s called HIPAA.
Re: Re: Smart Thieves...
First of all, how would you write a law like that if you were a politician?
With small, easy words the other politicians could understand.
Do you specify a particular encryption level? Does it apply to every piece of data that can be linked to a person?
I suppose you would have to specify an encryption level, and I say any data an identity thief could use, like your birth-date and social security number. Name and address aren’t really that important as far as stealing someone’s identity.
Wouldn’t that effectively give the government the right to come in and look at any data a company has, without a warrant or other legal notice, in the name of making sure this new hypothetical encryption law is being followed?
Well now that’s just plain silly. Of course the government would have to have a warrant if they suspected a company was not upholding the encryption law. I mean, the cops can’t bust down your door without a warrant for your computer (assuming they do not expect someone is about to be hurt inside your residence and even then they can only get the other person out and not collect any evidence).
There is one reason...
“because there’s no reason for them to protect it.”
While there may be no legal reason for protecting it, companies who lose customer data like this are penalised. Not by the gov’t but by the customers. If a customer doesn’t feel safe with you having there info they will not remain with that company. It has happened in the past, and I know of a few major companies who look at keeping customer data safe as a top priority. Banks have known this for year, I’m surprised other companies are taking so long to realise data leaks = bad thing.
Re: There is one reason...
The problem is without steep penalties from the government, most big corporations do not care about losing a few customers here and there. Maybe if they had a large enough fine, they would be more careful with personal data.
Problem is the laws
The problem is the laws. People that let identity information for companies they work for be stolen should get the death penalty. After a few owners of stolen CD’s are put to death, people will think twice about how secure their data is.
UCLA is one of the nation’s leaders in losing people’s information. They are never held liable for their information leaks, which is probably why it happens over and over.
Not only that, but UCLA is a school. Because it is a school, it has the right to use means that are illegal for commercial companys to track you down and to sell your information. The law states that you must contact UCLA and ask them not to sell your information, or they may do it.
I hate that UCLA tracks me down wherever I move within about 1 month. I hate that they hold onto my information. I hate that their data gets compromised so often.
These companies, and non profit institutions should be held fully accountable for these information leaks due to negligence.
Perhaps a lawsuit – they should be responsible for any identity theft that’s a result of this.
I’m curious – why has no one done that yet?
And hey – that’s worse than death for a big company – 100,000 lawsuits
Easy Solution
Maybe the politician’s would care if they realized how serious identity theft really is. We need some people to focus on stealing politician’s identities and ruining their credit.
Personal Info...
No bank account, no drivers license, no medical insurance (no records), no property, work for cash…
That’s the only way to keep the thought police at bay.
Why not make laws to protect SSN
I think if a company is going to transfer your data (SSN) etc. to a third party, then YOU should be notified. That is your property. You can’t change it, you can’t protect it, THEY sell it and make a profit. I think we should all get a cut of that!
Re: Why not make laws to protect SSN
Now you speaking my language. Maybe I can sure all the companies with my SSN for trademark infringement. I mean, that is MY number. I could start off with something reasonable, like 2 million per company…
HIPAA
As someone already pointed out, this falls under HIPAA and they can be fined BIG TIME. I know of a “network administrator” *cough cough* who setup a piss poor router for a medical billing company and he claimed to know about HIPAA. A year later they discovered the idiot left a major hole open and that data had possibly been compromised and my friend, who had warned him about all of this being a possibility, testified as an expert witness against him.
No wonder I lie about my SSN, etc. these days. I’m sure someone else will collect my benefits but I don’t really pay into social security anyway so what are they gonna get an extra $4/month?!!?
Re: HIPAA
HIPAA is the Health Insurance Portability and Accountability Act, so it only applies to Medical/Health companies.
What about credit card companies and such? What happens when the FBI screws up? Nothing.
Also, the company that lost the information was a subsidiary company under a Health insurance company. I’m not sure they can legally be fined using HIPPA, those rules apply to 1st party companies as far as I know.
Re: Re: HIPAA
Oops, not subsidiary company, but sub-contractor.
Re: Re: HIPAA
HIPAA was written in such a way as to create a “chain of custody” for your information. Basically any recipient or handler of information that was acquired under HIPAA must be HIPAA compliant.
Re: Re: HIPAA
The only reason HIPAA applies is that this particular instance was about an insurance company. No, it does not apply to credit card companies, and in fact, a lot of CC companies write the fine print of their contracts such that you authorize them to distribute your information as they please (for instance, report your credit status to the credit bureaus). Given that fact, I’m not even sure a law written to penalize the situation described would even work for a company where you sign an authorization for them to distribute your information.
Benefit of the doubt
Should note that it isn’t clear that the disk has actually been stolen. Although still a boneheaded thing to do, the fact is that the CD *could* have simply been misplaced (and I’ve seen important papers, CDs and even equipment go missing all the time and it has always been disorganization or carelessness that is the problem rather than thieves)
Burned CDs are not the most reliable way to transfer information anyway. Even if stolen, assuming the burned CD contents will still be legible on the CD a year from now is a bit of a stretch – all they have to do is actually leave it out on a sunny desk somewhere and poof – the data is gone.
Why only 1 year of
protection? Why not a life time of credit monitoring?
7ena esg,ayglqlalakfgtir nburht;hrc;ae g4;r7aphjarhbfkfba.bfhbahfekurh.akhrhnahefbasddjhdf.s;rg;sjghjggmhflguhhjhgvsa,hahahegyhb.efbyl.cyge.,a,fhyegjydefdywjtfaywftefrjaytykfghjlhldghdgfasygshfgsdylshdyaelghagdgfbcdhfbhsgadfhdbchsavjlyelz