In The News

Why Many Business Can’t Keep Their Secrets

Milo Gelling

Why are companies having so much trouble keeping their private information from falling into the wrong hands these days?

In recent months, there have been several well-publicized incidents of proprietary documents showing up in the hands of competitors or the media. The information is taken from its owners by the perennial causes of leaks: disgruntled employees, whistleblowers or sloppy procedures. But today, a confluences of factors – from the fraying bonds of loyalty between employees and employers to technology’s ability to disseminate data widely – is aggravating the problem of how to secure corporate information.

The thief may be inside the company, but the meshing of company computers and the internet has raised a bigger concern: unauthorized access form outside. “Over the last 10 years, I would say the threat of penetration from the outside was no less than 5% and no greater than 10%,” says Richard Power, senior analyst at Computer Security Institute in San Francisco, a consulting firm that tracks security breaches. “Now it’s well over 20%.”

Identity theft flourishes

Market grows for stolen personal financial information

Marcy Gordon

WASHINGTON – Bank account search: $249. Available around the country. Takes 10-18 business days.

Ads like this on the Internet are proliferating, experts say, despite a 10-month- old federal law prohibiting use of deceptive techniques to obtain people’s personal financial data from banks.

Such techniques, notably “pretext calling,” in which people misrepresent themselves to obtain the private data of others form banks and other financial institutions, are flourishing, congressional testimony indicated Wednesday. Pretext callers often pose as law enforcement agents, social workers, potential employers and other figures of authority.

Identity theft is one of the fastest-growing crimes in the United States. The cruder methods, such as digging through people’s trash for credit card receipts or bank statements, have been largely supplanted by more technologically savvy techniques. In the most advanced cases, hackers have been able to penetrate big corporations’ data bases and download credit card numbers and other data.

The National Association for Information Destruction, Inc. is commending Georgia Governor Roy Barnes for signing into law new legislation (SB475) which makes it a crime for any business to discard personal information unless it first “shreds, erases, modifies” and makes “reasonably” sure no one will have access to it before it is destroyed. The association, which is the non -profit trade organization of the shredding industry, says the new law is a big step in the right direction with consumers’ welfare as its primary focus.

Effective July 1, 2002, any company in Georgia which discards personal information without first destroying it , faces up to $10,000 in fines.

The bill primarily strengthens and broadens the penalties for Identity Theft and related crimes. In recent years, these have skyrocketed to become the fastest-growing and most common form of financial crime in the country.

Careless Disposal of Records Imperils Privacy

PAPER CHASE

A month ago, Aetna health insurance claim forms blew out of a truck on the way to a recycling center and scattered on I-84 in East Hartford during the evening rush hour.

Aetna, the nation’s largest health insurer, quickly dispatched employees — some of them on the way home from work — to scoop up forms containing names and personal health information.

Two weeks later, Fleet Bank deposit slips flew off a truck traveling to an incinerator, and were found blowing around downtown Bristol. Teams of Fleet workers, 20 the first day, and 35 the next — combed much of the route to the incinerator, retrieving 345 slips.

Similar incidents have occurred elsewhere in the country, privacy experts say. The Aetna and Fleet incidents have prompted Connecticut’s insurance department to reinstate into its insurance company examinations questions about procedures for disposing of documents with sensitive customer information.