Home Mobile Archives Reader Blogs Register Login

Tuesday, February 15, 2005

Database Security Problems

I hate to see this sort of thing.

MSNBC - Criminals posing as legitimate businesses have accessed critical personal data stored by ChoicePoint Inc., a firm that maintains databases of background information on virtually every U.S. citizen, MSNBC.com has learned.

The incident involves a wide swath of consumer data, including names, addresses, Social Security numbers, credit reports and other information. ChoicePoint aggregates and sells such personal information to government agencies and private companies.

Last week, the company notified between 30,000 and 35,000 consumers in California that their personal data may have been accessed by "unauthorized third parties," according to ChoicePoint spokesman James Lee.

California law requires firms to disclose such incidents to the state's consumers when they are discovered. It is the only state with such a requirement but such data thefts are rarely limited to a single geographic area.


Its bad enough that private information for thousands of U.S. citizens has now been released to criminals. What's even worse is that this event will likely result in some more knee-jerk privacy legislation that will further limit access to this information to the great detriment of businesses and individuals who have legitimate reasons to use it.

I use some of ChoicePoint's products in our business to help locate individuals for our clients for a variety of reasons. Sometimes we use it to locate people who have skipped out on debts or other obligations. Sometimes we use the information in compiling background checks so that employers like day care providers and telephone companies know that they aren't exposing their clients to criminals. These and other purposes are perfectly legal reasons for accessing said information and are beneficial to both customers and businesses alike.

Every time congress passes additional privacy legislation it limits my ability to provide these services to my clients. And when people like me can't provide this information my clients have no other recourse other than to forget about collecting information altogether and make their decisions based on other, less important criteria. When that decision is made it results in more criminals being hired by unsuspecting businesses and more debts going unpaid by people who cannot be found.

So when you get angry about this story (and you should be) keep in mind that ChoicePoint and companies like it do provide valuable services to the public. By all means, hold ChoicePoint responsible for this mistake. Its terrible that they made a mistake, but we must also weigh the consequences of further prohibiting access to this information before taking any legislative action.

Comments

Avatar for Internet Security: Be Careful Out There

The Regional Internet Registries have had a mishmosh of sloppy or non-existent practices to make those who register domain names provide good data - and the RIR’s maintenance of the data has been pretty shoddy, too. Remember, this is what got Choicepoint in trouble.  Until that bottom turtle is fixed, the next turtle up - using technologies like DNSSEC to make DNS less susceptible to poisoning attacks - really can’t happen. Which means the next turtle up,

Avatar for Michelle Malkin: CHOICEPOINT AND THE IDENTITY THEF

[...] Update: Rob at Say Anything, who is a private investigator, has an important perspective on the legislative juggernaut. See his cautionary notes here and here.  TrackBack <7> Powered by Movable Type 2.661   ·   Design by Sekimori   ·   Maintenance by Mark Jaquith © 2004-05 - Michelle Malkin - all rights reserved var site="s10michellemalkin" var if_Site_ID = “ipro”; var if_sid="1"; var if_protocol=window.location.protocol; var mep1="&Site="+escape("pajamasmedia.com"); [...]

Page 1 of 1        

Post a Comment


Before commenting, please recite:

Grant me the serenity to ignore the trolls,
the courage to debate with honest opponents,
and the wisdom to know the difference.

Name   
Email   
URL   
Human?
  
 

Upload Image    

Remember my personal information

Notify me of follow-up comments?

Note: Notifications will only be sent to confirmed email addresses.

    

By submitting your comment you agree to our terms of service.