I came across a thoughtful post about the recent GAO report on identity theft and data breaches written by Dissent, who blogs at the Chronicles of Dissent. This is a well-written analysis, and after reading it, I was inspired to think a few things through.
In Dissents own words:
The June GAO report, Data Breaches Are Frequent, but Evidence of Resulting Identity Theft Is Limited; However, the Full Extent Is Unknown [GAO-07-737 (pdf)] was released today.
Looking through it, it is clear that they relied heavily on data and statistics provided by Attrition.org, the Privacy Rights Clearinghouse, the Identity Theft ResourceCenter, and reports obtained from NY and NC under FOIA by Chris Walsh.
Although it is encouraging that that the government is actually using the data that these organizations and individuals have worked so hard to compile, some of the implications suggested by the GAO report are troubling from the perspective of a privacy advocate.
I’m going to link to the full article, which I think is a valuable read for anyone interested in this subject. Then I will give my personal opinion.
Chronicles of Dissent post, here.
Identity theft seems to a growing problem, at least whenever anyone takes the time to track the statistics. If this is true, then why would known data breaches result in very few cases of identity theft?
The answer is simple, when a data breach is exposed, it isn’t as easy to use!
When a data breach occurs, the human element (compromised) normally takes a lot of measures to protect their information. In fact, an entire industry (identity theft protection services) has come about, which is automating the process. This makes it harder, and probably, a lot more dangerous to use the information.
Everyone involved in studying this admits there are a lot of compromises no one knows about. These unknown compromises are probably, where most of the information being used to steal identities is coming from. After all, they don’t want to waste their time on information that won’t work, or even worse, put them at risk of getting caught.
One of the reasons the problem is growing is that not many of them are getting caught (my opinion).
At best, once a breach is known, someone is going to have to hold on to the information for later use (after people and organizations let their guard down).
Perhaps, these highly publicized data breaches have stopped the information from being used? If this is the case, it’s certainly a good argument for mandatory notification.
In closing, our personal information has been put in too many places, that don’t seem to be protected very well. The reason for this is pretty simple, also. There is a tremendous amount of money being made from selling it to market products.
As long as our information is being used for a profit and isn’t being protected properly, it’s only fair that those profiting should be held liable for all the notifications and clean-up.
Of course, I’m also in favor of going after the people compromising the information with a little more gusto. Since this costs money, I have no doubt, who should be helping to pay for that, also.
No one can ever be certain of anything until things become more transparent. This is why I often add that some of my thoughts are purely opinion, based on my observations of this phenomenon. I am always open to considering all points of view, and in fact, learn a lot by doing so.
(Courtesy of Flickr)
Loading ...
2 users commented in " Why the GAO report on Identity Theft might show that disclosure works! "
Follow-up comment rss or Leave a TrackbackHere’s another breach — this one from Disney — that attrition.org helped bring to light. Note that disclosure took something like 6 weeks, which isn’t exactly helpful, if you ask me.
http://www.networkworld.com/community/?q=node/17416
The point you make is valid. Such point, along with several other points, were discussed in an article at http://www.creditlock.com You may want to review such article titled “Identity Theft risk Undermined by Inconclusive GAO Data Breach Report ( http://www.creditlock.com/databreach.html )
I am amazed at the odd conclusion that most media are making, by quoting the first portion of the title of the report, and ignoring the second portion of the title….
Leave A Reply