[IP] ID Thefts: Lost Backup Tapes Are Not the Main Problem

[David Farber <dave@farber.net>]

Begin forwarded message:

From: Lauren Weinstein <lauren@vortex.com>
Date: July 6, 2005 5:23:30 PM EDT
To: dave@farber.net
Cc: lauren@vortex.com
Subject: ID Thefts: Lost Backup Tapes Are Not the Main Problem


> From: Ari Ollikainen <Ari@OLTECO.com>
> Subject: Re: [IP] SF Chronicle: Personal data lost -- again
>
>      For IP... Iron Mountain, "a leading data storage firm", lost
>      two back-up tapes. Interesting delay in informing customers
>      as required by California law

Dave,

Ironically, it's true that the probability of lost backup tapes
being used opportunistically for ID theft is probably fairly low,
at least in comparison to all the "ID theft supermarkets" that are
out there -- crooked commercial and government employees willing to
sell access to their files, Internet-based ID theft rings, and so on.

Have you been keeping up on the recent story of the India-based call
center worker who reportedly offered up all manner of customer
personal information for a fee?  Government officials in India are
replying that this happens all over the world so don't
differentially blame India -- not exactly an encouraging excuse.

The vast majority of these lost backup tapes probably were just
misplaced -- or end up in dumpsters -- never having even been read.

This is one reason why I'm unconvinced that encryption mandates will
make such a big difference to the bottom line of ID theft, and that
these lost backup tapes reports are really diverting our attention
from the major real sources of ID theft data.

Or to put it another way, nobody needs to bother trying to break
into Fort Knox (even with the help of a hat-throwing butler) when
there's so much ID theft money growing on trees everywhere ripe for
illicit, easy pickings.

--Lauren--
Lauren Weinstein
lauren@pfir.org or lauren@vortex.com or lauren@eepi.org
Tel: +1 (818) 225-2800
http://www.pfir.org/lauren
Co-Founder, PFIR
  - People For Internet Responsibility - http://www.pfir.org
Co-Founder, EEPI
  - Electronic Entertainment Policy Initiative - http://www.eepi.org
Moderator, PRIVACY Forum - http://www.vortex.com
Member, ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
DayThink: http://daythink.vortex.com



-------------------------------------
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/