Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×

ChoicePoint -- What We Learned from Our Screw-up 60

Posted by timothy from the ahem-ahem-ahem dept.
xpangler points out an article in Baseline magazine in which "ChoicePoint's lead privacy & compliance executives talks about the 'more than 30' new practices and procedures the company has put in place since it mistakenly sold private data on 163,000 people to Nigerian criminals last year."
This discussion has been archived. No new comments can be posted.

ChoicePoint -- What We Learned from Our Screw-up More

ChoicePoint -- What We Learned from Our Screw-up

Comments Filter:

  • Lesson 1 (Score:5, Funny)

    by OakDragon ( 885217 ) on Monday June 26, 2006 @02:59PM (#15607556) Journal
    Never trust anyone who says things like "Greetings!" and "Honorable", and who CAPITALIZES in very ODD places.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Monday June 26, 2006 @03:03PM (#15607588)
    Comment removed based on user account deletion

    • Re:Mental translation (Score:4, Insightful)

      by aztec rain god ( 827341 ) on Monday June 26, 2006 @03:14PM (#15607685)
      Isn't the real lesson from that whole debacle that Choicepoint has no business handling my personal information? It seems to me like if they really were to 'get it', they would find a different line of work to be in, and perhaps do some form of good for humanity. In my mind, the real transgression going on wasn't the 160,000- odd cases of Nigerians getting their hands on the personal data, its the unknown number of 'legitimate' transactions.

      I think you've hit a good point, that people have no say as to what is done with their info. There really needs to be a mechanism, or a form or something where I can tell Choicepoint to delete any records having to do with me.
      • "Isn't the real lesson from that whole debacle that Choicepoint has no business handling my personal information?"

        But that is their business -- handling and selling your information :)

        It would be more accurate to say that Choicepoint has no business if not handling your information (for better or worse).
      • There really needs to be a mechanism, or a form or something where I can tell Choicepoint to delete any records having to do with me.

        How many other companies give you that option? Even my auto mechanic has my address, phone, cell, email, and car information. If I don't go to him anymore and I go back and say delete my information, does he have to? What he wants to include me as a customer to financial backers when he expands? In any event, where's the proof that it's gone? It's certainly a frustrating
        • Most laws, in the USA anyway, come about because of someone else's failure.

          Eventually, someone will be seriously hurt by data loss/theft/whatever.

          Evenually, the data broker will be forced to pay with blood, money, or time in jail.

          Most likely, someone with substantial assets will get bitten bad and still have what it takes to sue the broker out of business...then the legislature AKA lawyers will get involved.
    • As evidenced by (FTFA):

      Another new measure: ChoicePoint this month created a security advisory committee comprised of DiBattiste, the company's CIO, head of internal audit, the chief business officer, chief marketing officer, chief administrative officer and general counsel. The group meets regularly "to ensure we're hitting every aspect of security and privacy," says DiBattiste.

      Emphasis mine.

      Maybe it's just me, but a roomful of CxOs, including the CMO (WTF? What's wrong with VP of Marketing?[1]), plus a

      • [1] Speaking of stupid CxO titles, what the hell is a "Chief Administrative Officer"?

        a) Chief Administrative Officer - in charge of paper clip chains and bottom photos from the copiers

        b) Chief Administrative Officer - new member of the Enterprise bridge crew:
        Picard: ...and this Commander Throckmorton, our Chief Administrative Officer.

    • Re:Mental translation (Score:1, Insightful)

      by Anonymous Coward
      When that is the case, I'll bet it much easier to clamp down on leaks and not reveal breaches to the public/government than prevent them.

      That thinking is totally backwards. They made a big mistake, the punishment was very minor. They make a mistake again and they then do something illegal and suppress the mistake and they get slammed? This is just like hit and run, if you run into someone, often if it's considered an "accident", you are fine, UNLESS, you run, then you're screwed. Better to take the b

      • Comment removed (Score:4, Insightful)

        by account_deleted ( 4530225 ) on Monday June 26, 2006 @03:23PM (#15607760)
        Comment removed based on user account deletion

        • Re:Mental translation (Score:1, Interesting)

          by Anonymous Coward
          THERE ARE NO REPERCUSSIONS! They say oops, a couple of blogs report it, and life goes on for them.

          That was my point. If the worse thing that will happen is a small fine and a hand slap, why would they take the risk of actually doing something illegal and going to jail by actually trying to cover up the mistake?

        • Turn off the spin (Score:4, Interesting)

          by HardCase ( 14757 ) on Monday June 26, 2006 @04:10PM (#15608149)
          What repercussions? Did they lose business? Sure they got hit with a 10 million dollar fine but look at their financial statements, that is barely a drop in the bucket for them.

          It was a total of $15 million, plus another $4 million in other obligations imposed by the FTC (like third party auditing). Insurance covered $11 million of the $19 million, but Choicepoint had to pony up $8 million of their own money. If you look at their financial statments, you'll see that it's no slap on the wrist - it represented half of their cash. In terms of yearly income, it's about 7% of what the company makes. Plus, I suspect that their insurer will either raise their liability insurance rates or drop them altogether.

          I'd say that the penalty was fair. It's not necessary to drive the company out of business - just necessary to give them a sting so that they don't do it again.

          -h-

          • Re:Turn off the spin (Score:4, Insightful)

            by Almost-Retired ( 637760 ) on Monday June 26, 2006 @08:15PM (#15609716) Homepage
            I'd say that the penalty was fair. It's not necessary to drive the company out of business - just necessary to give them a sting so that they don't do it again.

            No, sorry, that doesn't cut it with this old fart. Until they are put out of business, and their database put in escrow for purposes of forensics traceing only, with it to be preserved on non-networked servers that it takes a federal court order to gain access to, such shennanigans will continue. While they're at it, I'd be in favor of the top floor executives haveing a hand amputated in the grand old arab justice manner. Maybe both hands for the President of such a company.

            I frankly could care less about the collateral damages from putting many of such a companies rank & file people out of work, they knew full well the type of business they were working for. I cannot seriously seperate those people from all the 419 scammers in Nigeria. They're all birds of a feather. Put them out of business, mark them physicly for life and make it damned clear that this is what will happen to everyone that abuses the data they are in charge of. Then and only then will these leaches turn honest.

            --
            Cheers, Gene
            • Good lord. I wonder what would happen to society if we punished mistakes with such extremity. I bet some folks would immediately say "it would be better". But history has many lessons on this topic and that doesn't seem to fit.

              Cheers.
              • Good lord. I wonder what would happen to society if we punished mistakes with such extremity.

                You're missing the point. This isn't about "punishing" a single incident. It's about Choicepoint's whole business model, which would be illegal in a sane world.

                Until they radically restructure themselves to make their money in some other way, they shouldn't be in business.
            • For the longest time, the industry was pretty much unregulated. Now that the FTC is empowered to regulate them, companies like Choicepoint are faced with a choice - they can operate in a haphazard way or they can pay attention to the rules and tighten up their business. I'm no expert in the business, but I'd bet money that the companies are tightening up their business practices. Violations will happen. That's when the FTC steps in, makes a determination based on the nature of the violation and the circ
      • a friend of mine's husband went to prison for that, he was speeding and took some guy out. rather than sticking around he hid the smashed up car and is doing 5 years for it.

        if he had stuck around he probably would have gotten charged with negligent homicide or less and gotten less than one year

    • has taken numerous steps in the past year to make sure such a breach is never made public again.

      That's not up to them, however. The only way they can do that currently is to not keep any information whatsoever on a resident of California. Why? Because California has some of the best consumer privacy protection laws on the books. In this case the one that matters is the legally required disclosure of any potential privacy breach of residents. You are required to notify the residents that are affected... and

    • the company has taken numerous steps in the past year to make sure such a breach is never made public again.

      And you call yourself a cynic?

      As the scariest part about the original phrasing, I think Carol DiBattiste really means it... As in, she seriously has such a poor grasp of technology that she doesn't recognize "never happens again" as an impossibility.

      Any network security novice could tell her that it will happen again. They can take steps to contain such leaks; to minimize what a single attack
    • $15 million is a token fine? I wish the hell *I* had a few tokens.

  • Now they need to do quality control (Score:5, Informative)

    by meburke ( 736645 ) on Monday June 26, 2006 @03:12PM (#15607670)
    ChoicePoint is an aggregator. As much as 20% of their data could be inaccurate. Employers (for instance) make decisions based on ChoicePoint data, even though ChoicePoint "suggests" that they independently verify the accuracy of any negative reports. (Of course, it may work the other way also: 20% inaccuracy suggests that ChoicePoint will give subscribers false positive data, too.) Is this important? Well, Baseline Magazine wrote a nice article on this last year, http://www.baselinemag.com/article2/0,1540,1825320 ,00.asp [baselinemag.com]
    http://www.baselinemag.com/article2/0,1540,1825287 ,00.asp [baselinemag.com]
    and I was really impressed with the fact that a Home Depot employee spent a week in jail for crimes he did not commit.

    Security is only half of it; Accuracy is the other half.
    • Sorry, the article says Frye's, not Home Depot...I should have double-checkd before writing.
    • Nice way to not read your own FA. He worked for Fry's, not Home Depot.
    • I had this happen to me. I was supposed to start a job on monday the day after thanksgiving break.

      Wednesday I get a call from the head of HR wanting to know about my felony charge in Rochester, NY. I'd never been to Rochester and had no idea what she was talking about.

      In this case, the company doing the background check had not even bothered to verify my social security number and such. Just pulled up the name, which isn't all that unique.

      Fortunately the HR head understood that these things are often wro

  • Pop quiz (Score:5, Insightful)

    by Rob T Firefly ( 844560 ) on Monday June 26, 2006 @03:16PM (#15607709) Homepage Journal
    It's enhanced user ID and password protections--if employees forget their passwords, they must take a five-question quiz (example: "What year was your Social Security number issued?") to reset it; if they fail that, they must pass a 15-question quiz with a systems administrator.
    I'm sure that makes everyone feel better and inspires lots of Holy Grail "What... is your favorite color?" gags, but as long as the info exists in records for someone to verify, it's open to being copied and used by the wrong people.

  • Non-US? (Score:3, Interesting)

    by mr100percent ( 57156 ) on Monday June 26, 2006 @03:54PM (#15608019) Homepage Journal
    ChoicePoint has blocked access to its network from all non-U.S. Internet addresses, with a few exceptions that DiBattiste declined to detail.

    To who? ECHELON?

    • Re:Non-US? (Score:1, Informative)

      by Anonymous Coward
      So they're keeping the data out of countries where it would be legally protected, and ensuring that it is only held and accessed in the USA. That would be a country where:

      - There is no privacy legislation that has teeth, and

      - The government can ask for the data without any real reason and make it illegal to reveal that the data was turned over.

      Feel safe, my American colleagues. (Take that pill if it helps).

      Do you ever wonder why foreign citizens won't do business with your companies? Why the Canadians won't

  • Love this quote... (Score:1, Interesting)

    by Rinzai ( 694786 )
    And the company now encrypts all data feeds...



    Oh. NOW. That would have been my first idea. Sensitive data? Encrypt it!


    That's why I don't work in network security.

  • I don't think anything they could have done or said would make any difference in my opinion about them.

  • Progress Indeed (Score:2, Interesting)

    by SupremoMan ( 912191 )
    I have used Choice Point products at my last job. Following their little... ummm... mishap they changed my username (which they assign) from the first latter of my first name followed by my last name to random assortment of character. Progress indeed.

  • Their Other "Mistake" (Score:4, Interesting)

    by edward.virtually@pob ( 6854 ) on Monday June 26, 2006 @04:58PM (#15608521)
    When are they going to talk about their "mistake" in 2000 when they helped Bush steal the election in Florida by illegally removing blacks from the voting rolls [gregpalast.com]? Or has everyone forgotten about that by now? It'd sure be nice to see some of these traitors to our country get their Constitutionally mandated punishment, vs. being interviewed in magazines.

    • funny, that - I just read the article that you yourself gave a link to. FTA ..... the list supposed to be a list of felons from the state of Texas. Most of the people on that list had misdemeanors, not felons .... is that THIER mistake, or something you should be pissy about the State of Texas about? 2nd .... the article says that the law fobidding felons to vote unfairly targets minorities because it eliminates 31% of black men from voting. I would be VERY surprised if a third of black men in Florida wer
      • the list supposed to be a list of felons from the state of Texas. Most of the people on that list had misdemeanors, not felons .... is that THIER mistake, or something you should be pissy about the State of Texas about?

        Its pretty clearly up to Choicepoint to provide accurate data, otherwise if there is no accountability they might as well just make up a bunch of names and use those instead.

        If their source was bad, they should have either found another source to validate the data (they should be doing that a
        • Its pretty clearly up to Choicepoint to provide accurate data, otherwise if there is no accountability they might as well just make up a bunch of names and use those instead.

          Actually, no. Per state law requirements, ChoicePoint was hired (by Democrat Ethel Baxtor) to provide a list of possible convicted felons to each county, and each individual county election supervisor was required to verify the names on the list, provide an avenue for appeal, and ultimately remove previously convicted felons from the
    • The reason nobody is talking about this is because:

      1) It's wrong. The US Civil Rights Commission failed to find a single person who was incorrectly removed from the voting rolls and not allowed to vote in the 2000 election because of the Felon list.
      2) ChoicePoint had no authority or means to remove voters from the rolls. Only the local county election officials did. 3) That was 6 years ago, and most whiny liberals have given up crying about this non-issue by now.
      4) Subsequent independent media rev

  • What I learned from Their Screw-up (Score:3, Insightful)

    by PingXao ( 153057 ) on Monday June 26, 2006 @05:33PM (#15608818)
    Americans need an ammendment to their Constitution that guarantees them the Right To Privacy. Then, assumiung a Congress that actually follows the Constitution can be elected, in conjunction with the Right To Privacy there should be a law that prohibits the use or sale of my personal data without my prior consent. Better: it should be against the law to even collect and store that information in any database where the consumer - citizen, if you will - doesn't have the ability to "SQL DELETE FROM * WHERE NAME = ME".

  • Joke? (Score:1)

    by PGC ( 880972 )
    " ... since it mistakenly sold private data on 163,000 people to Nigerian criminals last year."

    This is a joke, right ?

  • Consider the Source (Score:3, Interesting)

    by ZWithaPGGB ( 608529 ) on Monday June 26, 2006 @06:48PM (#15609308)
    Ms. DiBattiste doesn't have a very good rep as a privacy advocate. [privacyclue.com]
  • how do you mistakenl sell personal data to nigerian criminals you dont even bother to find out who your customer is?

Slashdot Top Deals

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Close