20 ms·

Marriott Concedes 5M Passport Numbers Lost to Hackers Were Not Encrypted

360 points by adriand 8y ago

kyoob 8y ago
Why do they even have that many passport numbers saved in any format? I get what a spy organization could do with that information. What does a hotel organization do with it?
- bilbo0s 8y ago
  >I get what a spy organization could do with that information. What does a hotel organization do with it?... Give it to the spy organization. Not being snarky. That was meant as a serious comment. Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel?
  - sethhochberg 8y ago
    At least within the EU, it is required that hotels record the passport numbers of people who stay with them for potential future law enforcement use. Most countries just require the data be kept on file at the hotel, but a few regularly collect it in some kind of central database.
    - ghaff 8y ago
      And, especially with a big chain, I assume that any information they collect (especially if they're required to collect it) gets put in a centralized database rather than depending on a paper copy being properly filed in a file cabinet someplace. Somewhat OT but I was in Europe last month on a business trip. There's a knock on the door one evening. Imagine my surprise in discovering it's someone from the hotel who has come up with a few edible goodies for my birthday. On the one hand, it was a nice gesture. On the other, I was a bit taken aback. Where did they get that info? I didn't really want to ask but a friend of mine later reminded me that they probably got it off my passport. I suppose this might have just been an informal process at this particular hotel. But I wouldn't be shocked to learn it was put in the chain's database.
      - akshatpradhan 8y ago
        How does GDPR play into the requirement to store passport numbers?
        ryanlol 8y ago
        It plays. The way these hotels are doing this maybe probably isn't GDPR compliant, but the same applies to vast amounts of other things. Hard to share any very useful insights on this, it's just the state of most things.
        akshatpradhan 8y ago
        Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? Can hotels be fined if they’re found to not be GDPR compliant?
        ryanlol 8y ago
        >Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? I'm not quite sure what you mean, but the answer is probably no. >Can hotels be fined if they’re found to not be GDPR compliant? Sure, but is anyone GDPR compliant yet? I'd imagine that all the DPAs in EU are extremely busy right now.
        Xylakant 8y ago
        If there’s a legal requirement to store passport numbers you can store them. It’s one of the cases where you don’t need consent. You still have to store them in a safe fashion and the customer still retains most of the rights under GDPR (information about what you store and for which purpose, etc.)
      - ryanlol 8y ago
        All big chains will definitely keep track of your birthday if you're a member of their rewards program.
    - deleted 8y ago
      [deleted]
    - ben_w 8y ago
      I don’t believe that’s a requirement in the UK or Finland (though my last hotel stays in each was via Booking.com and I guess it’s possible that was sent automatically from Booking.com records, I can’t remember what they asked me for when I signed up)
      - Diggsey 8y ago
        The main reason it's required in the EU is because it's so easy to cross land borders without leaving a trace. In the UK, there's no need because it's an island, so passports can be more easily screened at the borders.
        ben_w 8y ago
        That implies it’s a Schengen Area rule?
        Symbiote 8y ago
        This thread is full of the usual HN Europe-speculation. My speculation is that this isn't something the EU has legislated on, so it varies between countries. In the UK, "The Immigration (Hotel Records) Order 1972" says: > 4.—(1) Every person of or over the age of 16 years who stays at any premises to which this Order applies shall, on arriving at the premises, inform the keeper of the premises of his full name and nationality. > (2) Every such person who is an alien shall also— > (a)on arriving at the premises, inform the keeper of the premises of the number and place of issue of his passport, certificate of registration or other document establishing his identity and nationality; and
        ben_w 8y ago
        Thanks; that certainly explains why I’ve never noticed the passport requirement in UK hotels — being British.
  - gambiting 8y ago
    I mean, most places I've stayed at take a photocopy of the passport, it's kept in case of any police enquiries.
  - isostatic 8y ago
    > Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel? Some countries (China and Russia spring to mind) require you to register your lodgings with the police, which the hotel do for you. It seems standard practice to hand over your passport at international hotels. Israel sometimes has more nefarious reasons than tracking where foreign citizens are https://www.gov.uk/foreign-travel-advice/israel/safety-and-security https://www.gov.uk/foreign-travel-advice/israel/safety-and-s... A Serious Organised Crime Agency investigation into the misuse of UK passports in the murder of Mahmud al-Mabhuh in Dubai in January 2010 found circumstantial evidence of Israeli involvement in the fraudulent use of British passports. This has raised the possibility that your passport details could be captured for improper uses while your passport is out of your control. The risk applies in particular to passports without biometric security features. Only hand your passport over to others (including Israeli officials) when absolutely necessary.
  - idontpost 8y ago
    > Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel? This is the case in most countries I've traveled to.
- sergers 8y ago
  not defending, but plausible reasons: form of identity. concierge service to lookup status/book travel for guests.
- ryanlol 8y ago
  Passport numbers are the easiest and perhaps the only way for these hotels to uniquely identify and track their customers. A ton of jurisdictions also require hotels to store these.
  - maxerickson 8y ago
    So which hotels limit their storage to the legal requirements?
    - ryanlol 8y ago
      Do not stay in any hotels if you do not want your personal information collected and shared with various third parties. Airbnb and similar tend to be vastly friendlier to privacy-conscious travelers, usually collecting less than legally required (they also do a very bad job of verifying what they do collect).
      - ghaff 8y ago
        Well, with Airbnb, you're presumably registered on the site and have a credit card on file which is how you pay. In general (at least in the US), lower-end independent motels and the like will often be less rigorous about checking ID and will probably let you pay cash.
        ryanlol 8y ago
        You can acquire a relatively anonymous prepaid card and use that to pay airbnb. Also, at least the last time I tried their ID verification thing didn't care about the name on the ID so you could just use any random ID from wikileaks to verify your account. Yeah, in the US the hotel situation tends to be significantly better than in the EU.
        ghaff 8y ago
        Good point about prepaid cards. Like anything of this nature, a lot depends on who you're hiding from and why. It's one thing to thwart generic big corporation knowing where you've been and what you've bought. It's another to be hiding from someone who has some degree of access to your computer and financial accounts. It's still another to be actively hiding from individuals or entities with varying degrees of law enforcement authority and varying degrees of interest in tracking you down.
- jlmorton 8y ago
  It's a government requirement in many jurisdictions, including much of Asia and the EU. Note that in the EU, at least, the data is not sent to the government authorities, but it must be available to them.
  - cr0sh 8y ago
    So do those jurisdictions provide passports for free (or very low cost) and/or make them easy to acquire? In the US to get a passport isn't an arduous process, but it isn't easy nor cheap; when I got mine done (full thing - card and actual passport), I had to first get a passport photo taken and paid for (walgreens), then go to a local courthouse during a weekday (which I had to take off the time for), then pay a bunch of money (oh - and I had to give them my birth certificate and some other ID - which I got back when I received my passport weeks later) - then wait. I think there were fingerprints involved too... Anyhow - it wasn't an easy or cheap process, but I can understand why they make it that way. But for most people in the US, unless they travel internationally, they never obtain a passport, because of this process. It is only set up for people who can afford it (both in time and money). So - if it is a requirement in other areas of the world, then receiving or obtaining a passport would have to be made easier for those who couldn't afford the time or money; time could be made by legislation making employers provide time for doing such a thing, and/or keeping courts or wherever to process the applications open on weekends or have later hours or something. Of course - we are talking about "non-US" places, which seem to have far saner social policies under which this would fall...
    - andylynch 8y ago
      At least in the EU/EEA, most countries have national ID cards, and you can travel with those instead.
    - Karliss 8y ago
      Don't know about other EU countries but here everyone older than 15 years is required to have a passport or id card by law. The fee is ~1/4 of what it costs in US. You don't need to make a photo before as it can be taken during application. If you don't want to wait in queue it is possible to make an appointment by phone.
- chrisseaton 8y ago
  > What does a hotel organization do with it? It's a requirement for hotels to have passport numbers in many jurisdictions. Have you never used a hotel before?
  - kyoob 8y ago
    Yes I have used a hotel before.
    - deleted 8y ago
      [deleted]
  - jandrese 8y ago
    If you are in-country you can use an in-country ID instead--drivers license number most often. I've never had a hotel ask for my passport when traveling in the US as an American for example. I'm sure they would take it if I offered, but my drivers license is considered sufficient.
sneakernets 8y ago
Is anyone surprised that assigning numbers to people to identify them seems to backfire every time it's tried?
- ngneer 8y ago
  Numbers have to be assigned in order to break the symmetry. Otherwise how would you tell humans apart?
  - politician 8y ago
    Coarsely, the reason for the need to tell humans apart is to assign debts.
    - pkaye 8y ago
      Would you be fine having your medical history mixed with someone else with the same name?
      - drewmol 8y ago
        Yes, I would even be willing to pay a small fee for this. (not the op)
        politician 8y ago
        (op here) The premise of the grandparent is an illusion that depends on the idea that somehow a medical provider (which one?) is a better caretaker for your medical history than you are. In the cases where that is actually true, power of attorney is the real solution -- not EMR records hosted offsite by 3rd party vendors in 3rd world countries on behalf of one or more hospitals. How absurd. My medical history is mine; it's ultimately not yours. If you need my medical history, allow me to give you limited access to it. Now, if your billing is opaque and you're playing shenanigans with the insurance companies about who owes what, then sure, you need my Passport, SSN, DNA, Real ID, and biometrics -- and you should probably hold my medical history hostage too -- to make sure that you can collect on the debt.
pasbesoin 8y ago
It seems law and regulation are going to have to clearly define and constrain what these organizations are allowed to collect and what they are not allowed to collect -- or, rather, that everything else is off-limits. Guests need to be offered the question of whether they care to share X data, and guaranteed that a "no" answer will not affect their ability to do business and receive services in the slightest -- nor the price they receive. Many people scream bloody murder WRT regulation. However, here we have a clear and repeated industry failure -- one with significant knock-on costs and risks. So, tough. You failed. I could also cough up a protest on my part against the whole misleading notion of "self-regulation". And point out that in an era of increasing consolidation into brands under very few and very large holding companies, effective competition -- including and with respect to data and security practices -- is largely absent. P.S. Where data collection is required, standards and aggressive auditing should be funded and enforced. People in the U.S. generally seem to have no problem with FDA regulation and inspection of meat production. (Not realizing how industry political initiatives continue to stress and periodically threaten this, e.g. inspection budgets.) Well, it seems we're to the point of needing and FDA for data, or something like. I say this with trepidation. And any initiative should come with a healthy dose of "audit the auditor", to keep requirements and process transparency to a maximum and minimize the governments' own carve-outs and attempts to siphon off the data whose processing are under inspection. Back to my accounting days. How do you prevent mistakes, error, and fraud? Well, orthogonal processes with robust cross-checks certainly help.
- true_religion 8y ago
  With regards to EU law, hotels are required to keep the passport numbers of foreign national guests on file.
- jstanley 8y ago
  The only reason the hotels are collecting passport numbers in the first place is because of regulations requiring them to.
  - lotsofpulp 8y ago
    It also helps verify against people causing damage to the hotel. Business where the transaction is not a simple "seller provides item - buyer pays seller" have different risks involved, and therefore need to additional measures to protect against them. Requiring credit cards, government issued photo ID, age over 21 are all methods of preventing guests who trash rooms, sneak in pets and cause noise disturbances, underage partiers, pimps and hookers, drug dealers, excessively dirty and causing pest problems etc from messing up the business. Same with car rentals and flights. Some people are problematic, and it affects other customers, and you need a way to mitigate the problem. In the US, almost all local ordinances require hotel operators to keep track of who is staying in which room for a year or so (some even require photocopying, although that's not always followed), and to hand over that info to police whenever they demand it.
40acres 8y ago
I would've thought by now the security consultant industry would be really robust and large corporations like Marriott would be advised to handle low hanging fruit like "encrypt everything". Anyone know the current state of the industry?
- munchbunny 8y ago
  I think this blog post from Brian Krebs captures the problem pretty well: https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/ https://krebsonsecurity.com/2018/12/a-chief-security-concern... There's a lack of attention at the executive and organization levels in these major corporations, so they're not set up to deal with security threats in a forward looking way.
- ganoushoreilly 8y ago
  The industry is robust, companies just refuse to spend money on security because the risks aren’t all that great to them and insurance policies are paid out regardless.
  - jlgray 8y ago
    I'm ever so slightly optimistic in this regard. As soon as we see a few GDPR-related penalties assessed, the risk-reward calculation will change drastically. According to their 2017 annual report [1], Marriot had $22.9bn in worldwide revenue. A 4% penalty on that would be $900M. [1] https://marriott.gcs-web.com/static-files/057a8e1a-a5c5-4c20-a51c-0b20bf8a0bc1 https://marriott.gcs-web.com/static-files/057a8e1a-a5c5-4c20...
    - reaperducer 8y ago
      I read that there was some kind of grace period involving GDPR penalties. Has the EU handed out any fines yet, or is it still letting companies adjust?
      - qznc 8y ago
awat 8y ago
Needs to be substantial penalties for these transgressions or it's just another "cost of doing business".
- ascorbic 8y ago
  A lot of these are likely to have been from EU residents, so there certainly could be some very large fines coming their way, courtesy of the GDPR.
  - alkonaut 8y ago
    Wow, I didn’t think about that - it applies to EU citizens even when not in the EU. And for a few types of business you have to have physical presence where you operate (hotels is one) so the EU can always force Marriott to pay up or extort the money from their business in the EU.
madeuptempacct 8y ago
Heh. A dev at work pushed our Azure cloud key to GitHub two days ago. A day ago we got a $250,000 bill for hundreds of virtual machines running at full capacity. Silly hackers.
throwaway456321 8y ago
Marriott. A bunch of tossers.
IshKebab 8y ago
What can malicious people do with my passport number?
- jandrese 8y ago
  Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus.
  - ghaff 8y ago
    Not that one wants this sort of information to be leaked of course, but it's hard to see information that is routinely copied by hotel desk clerks and which is written down on countless forms is deeply sensitive information that will cause dire outcomes if it gets out.
    - coltonv 8y ago
      You mean like your bank account number, which is constantly typed into online forms of all sorts of websites. Or your credit card number, which you probably say verbally into the phone to pay your bills? Truth is, lots of extremely sensitive data exists in insecure states all the time.
      - ghaff 8y ago
        For that matter, your bank account number goes on pieces of paper called checks that many of us give to individuals and companies all the time to pay bills. So, yes, I draw a distinction between numbers that we hand out willy-nilly and truly sensitive information. There's a big difference between my checking account number and my health records.
  - ryanlol 8y ago
    >Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus This would only require a name, not a passport number. A passport number would simply be of no use here, there doesn't exist any¹ automated mechanism for Belarus to verify foreign passport numbers. ¹Well OK, with biometric passports it is possible to cryptographically verify some data.
fatjokes 8y ago
Will they be penalized? Was Equifax ever penalized? The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job. Marriott currently has no incentive to spend money to do a good security audit. They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.
- robin_reala 8y ago
  Given that they have EU customers I imagine that yes, they’ll be penalised.
  - GordonS 8y ago
    GDPR is very recent - do we know exactly when the compromise was? If it was before GDPR came in, they might be able to weasel out of any potential penalty.
    - walshemj 8y ago
      And logging passports of foreign visitors is the norm in the EU - I suspect the national security exemption would apply - be interesting what the European court of justice would say if asked.
      - hadrien01 8y ago
        Exemption for being allowed to store them is arguable, but they could still be prosecuted under data protection.
      - rue 8y ago
        I would not imagine even the legal requirement would reduce the safeguarding requirements nor allow an increase to the necessary retention period.
ex3ndr 8y ago
Curious question. How they could encrypt this information when managers at help desks in the hotels need that information, say, for verification? Isn't it steal password from temporary worker will be super easy anyway?
- diminoten 8y ago
  You can decrypt the encrypted info, which is what you want to do with PII at rest, which I'm assuming is where the data was taken.
embwbam 8y ago
If you’re doing a new startup, and have aggressive timelines, what security measures would you implement to protect PII from day 1? I’m an experienced dev but not a security expert.
- thinkingemote 8y ago
  I'd suggest hiring an expert, assuming the startup is funded
- ummonk 8y ago
  Two factor authentication for all developer accounts, require TLS 1.2 to access the website and add HSTS, have some system for ensuring all SQL queries are sanitized, use bcrypt or scrypt with recommended settings to hash user passwords, add a content-security policy, enable secure and same-site attributes for cookies, as well as http-only, and add a double-submit csrf token. That should cover the basics to start with, in rough order of priority, assuming you're building a web app. Also, in general, be conservative about what PII you collect; hackers can't steal information you don't have.
wdn 8y ago
Until someone is held responsible, big corporations would not care about customer's data. It probably cheaper to give everyone a year of credit monitor (which not everyone used) than implement security to protect customer's data. This data breach is reporting every week, yet nothing is being done.
jliptzin 8y ago
Any data we turn over to companies should be treated as compromised. There should be a way to issue new SSNs. Things that can’t be changed like birthdays, addresses, and last names shouldn’t be stored by companies without very good reason.
anonymous5133 8y ago
Why does Marriott have passport numbers to begin with? This really comes down to companies simply collecting way too much information. Consumers need to push back against this type of data collection. Only give information which is clearly required for their business and nothing more. Also the companies should only retain that information for long enough to conduct their business.
- seattle_spring 8y ago
  A lot of countries require hotels to collect information that proves that the guest is there legally.
  - hiccuphippo 8y ago
    In my country hotels are even required to make a photocopy of the passport/id when a Traveller checks in. Having your id being public is not more of a security issue than your name being public.
- confounded 8y ago
  This is really the nub of the issue. I love that when I’m traveling for business everything is arranged for me, but I hate that I get put in situations where I’m booked into big hotels with policies like this. Increasingly it seems like there should be some kind of regulation that (with exceptions) if a good or service costs money, you should be able to buy it in exchange for money, and refuse to provide personal information even if requested.
  - ghaff 8y ago
    It's often required by the government where the hotel is located.
ummonk 8y ago
Note that encryption at rest isn't a panacea. Since every system that accesses the data needs to have the decryption key, if the hacker is getting the data by hacking one of those systems, then the encryption at rest has achieved nothing.
- r00fus 8y ago
  > then the encryption at rest has achieved nothing That's a bit of an overreaction. It has at least guaranteed that the intruder has active keys on a relevant system that can access the data. It ups the ante with reasonable/minimal cost. Encryption at rest is a defense-in-depth approach allowing you to be sure that e.g. some random stolen backup image (perhaps of a 3rd party system) doesn't expose your etc/shadow or user tables for subsequent rainbow-table attacks.
- germainelong 8y ago
  This is so short sighted I can't believe you are serious and not trolling. Every precaution has its limitations but why give the attackers a free meal? Encrypted data protects from simple theft or loss of the device so a common thief won't leak the data.
  - ummonk 8y ago
    You seem to be arguing against something I never implied. I said it's not a panacea. Do you disagree?
    - germainelong 8y ago
      You implied that encryption is optional whereas this shouldn't even be a discussion.
- scosman 8y ago
  Not a panacea, but always required. All disks eventually are thrown out. It doesn't prevent all attacks, but it's the only way to prevent a very common class of attack.
hiccuphippo 8y ago
Why is having a person's passport number a security issue in the first place? What could a malicious person do if they have your passport number?
- scarlac 8y ago
  Unfortunately passport number is considered semi-secret to the point where you can retrieve very personal information with it or with a tiny amount of extra info such as last name + passport number. Passport numbers are also permanent, until replaced. Or to put simply: Passport numbers make identify theft easier.
mephistosec 8y ago
Nothing was 'lost'. A misplaced laptop is lost; records from a database are accessed (or 'stolen', but I think that's problematic as well). The fact that the access was possible says nothing about the hackers and everything to do with Marriott's security approach and posture. Can we please stop letting companies hand-wave away these attacks and stop solely blaming hackers? I've worked with hundreds of companies' security teams. While I've seen a select few companies do a really great job, most were either negligent, incompetent, or both. I'm sick of the blame for this being laid solely at the feet of the abstract "hackers", rather than the people who make these attacks utterly trivial. (Posted from a throwaway because Marriott may or may not be a customer of mine. Ugh.)
germainelong 8y ago
Companies should not be allowed to have such sensitive data or the punishment should be severe - I mean the entire board should look at doing time. Currently as the law is, the rich can just laugh and carry on.
davidf18 8y ago
I am confused. Is there a way to check on-line about whether passport was compromised? Also, it doesn't make any sense to wait for an accident to happen -- it is better to replace the passport before there can be any fraud.
miohtama 8y ago
They will be punished in European Union where they have business presence. They had EU passports there. Under GDPR negligence is punishable. UK ICO hopefully will intervene in few months. In USA remedy actiona are class action lawsuit driven and corporations do not have incentive to change their behaviour.
alltakendamned 8y ago
Now chant with me... GDPR... GDPR... GDPR...
jarjoura 8y ago
Throughout my travels my passport number has been copied with an old school copier, entered into excel spreadsheets and held on to by various shops for collateral. Not saying this isn’t a shitty hack, but I feel like the passport is the least secured document attached to me I have.
- linkmotif 8y ago
  I thought you should never, ever give your passport to anyone, especially for collateral. Right?
  - ryanlol 8y ago
    Dunno, depending on your country they can be pretty easy to replace and they do tend to work quite well as collateral. This entirely depends on your situation, for example I don't think there are many places where it'd be a huge deal for a white westerner to lose their passport.
    - Quanttek 8y ago
      Are you sure you're not conflating IDs with passports? Though, yeah, in Germany at least it's quite easy to replace passports
myrandomcomment 8y ago
Uh, was in China more the once so I think if they are responsible it is not something they do not have ;) I think I have become numb to this stuff. I just assume it’s all out there and thus keep an eye on my credit reports, et.al. I am more pissed about the basic level of OPsec I see at these companies. I am even more worried about the same thing at our Defence contractors and related companies.
deleted 8y ago
[deleted]
amrx431 8y ago
And to which software sweatshop was the IT out sourced to ?
alexeiz 8y ago
I logged into Marriott to change my password... and I couldn't. Their web page responsible for changing password times out. What kind of POS system is that?
- zachberger 8y ago
  Seems like you've been out of the loop. They've been experiencing massive computer problems since August. https://www.wsj.com/articles/inside-the-marriott-starwood-loyalty-program-turbulence-1543416010 https://www.wsj.com/articles/inside-the-marriott-starwood-lo...

360 points by adriand 8y ago

Why do they even have that many passport numbers saved in any format? I get what a spy organization could do with that information. What does a hotel organization do with it?

bilbo0s 8y ago
>I get what a spy organization could do with that information. What does a hotel organization do with it?... Give it to the spy organization. Not being snarky. That was meant as a serious comment. Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel?
- sethhochberg 8y ago
  At least within the EU, it is required that hotels record the passport numbers of people who stay with them for potential future law enforcement use. Most countries just require the data be kept on file at the hotel, but a few regularly collect it in some kind of central database.
  - ghaff 8y ago
    And, especially with a big chain, I assume that any information they collect (especially if they're required to collect it) gets put in a centralized database rather than depending on a paper copy being properly filed in a file cabinet someplace. Somewhat OT but I was in Europe last month on a business trip. There's a knock on the door one evening. Imagine my surprise in discovering it's someone from the hotel who has come up with a few edible goodies for my birthday. On the one hand, it was a nice gesture. On the other, I was a bit taken aback. Where did they get that info? I didn't really want to ask but a friend of mine later reminded me that they probably got it off my passport. I suppose this might have just been an informal process at this particular hotel. But I wouldn't be shocked to learn it was put in the chain's database.
    - akshatpradhan 8y ago
      How does GDPR play into the requirement to store passport numbers?
      - ryanlol 8y ago
        It plays. The way these hotels are doing this maybe probably isn't GDPR compliant, but the same applies to vast amounts of other things. Hard to share any very useful insights on this, it's just the state of most things.
        akshatpradhan 8y ago
        Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? Can hotels be fined if they’re found to not be GDPR compliant?
        ryanlol 8y ago
        >Can GDPR be used as an audit mechanism for breached passport numbers? And if so, what would that process look like? I'm not quite sure what you mean, but the answer is probably no. >Can hotels be fined if they’re found to not be GDPR compliant? Sure, but is anyone GDPR compliant yet? I'd imagine that all the DPAs in EU are extremely busy right now.
      - Xylakant 8y ago
        If there’s a legal requirement to store passport numbers you can store them. It’s one of the cases where you don’t need consent. You still have to store them in a safe fashion and the customer still retains most of the rights under GDPR (information about what you store and for which purpose, etc.)
    - ryanlol 8y ago
      All big chains will definitely keep track of your birthday if you're a member of their rewards program.
  - deleted 8y ago
    [deleted]
  - ben_w 8y ago
    I don’t believe that’s a requirement in the UK or Finland (though my last hotel stays in each was via Booking.com and I guess it’s possible that was sent automatically from Booking.com records, I can’t remember what they asked me for when I signed up)
    - Diggsey 8y ago
      The main reason it's required in the EU is because it's so easy to cross land borders without leaving a trace. In the UK, there's no need because it's an island, so passports can be more easily screened at the borders.
      - ben_w 8y ago
        That implies it’s a Schengen Area rule?
        Symbiote 8y ago
        This thread is full of the usual HN Europe-speculation. My speculation is that this isn't something the EU has legislated on, so it varies between countries. In the UK, "The Immigration (Hotel Records) Order 1972" says: > 4.—(1) Every person of or over the age of 16 years who stays at any premises to which this Order applies shall, on arriving at the premises, inform the keeper of the premises of his full name and nationality. > (2) Every such person who is an alien shall also— > (a)on arriving at the premises, inform the keeper of the premises of the number and place of issue of his passport, certificate of registration or other document establishing his identity and nationality; and
        ben_w 8y ago
        Thanks; that certainly explains why I’ve never noticed the passport requirement in UK hotels — being British.
- gambiting 8y ago
  I mean, most places I've stayed at take a photocopy of the passport, it's kept in case of any police enquiries.
- isostatic 8y ago
  > Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel? Some countries (China and Russia spring to mind) require you to register your lodgings with the police, which the hotel do for you. It seems standard practice to hand over your passport at international hotels. Israel sometimes has more nefarious reasons than tracking where foreign citizens are https://www.gov.uk/foreign-travel-advice/israel/safety-and-security https://www.gov.uk/foreign-travel-advice/israel/safety-and-s... A Serious Organised Crime Agency investigation into the misuse of UK passports in the murder of Mahmud al-Mabhuh in Dubai in January 2010 found circumstantial evidence of Israeli involvement in the fraudulent use of British passports. This has raised the possibility that your passport details could be captured for improper uses while your passport is out of your control. The risk applies in particular to passports without biometric security features. Only hand your passport over to others (including Israeli officials) when absolutely necessary.
- idontpost 8y ago
  > Maybe there is some kind of requirement to inform the appropriate organizations of the passport numbers of any foreigners in your hotel? This is the case in most countries I've traveled to.
sergers 8y ago
not defending, but plausible reasons: form of identity. concierge service to lookup status/book travel for guests.
ryanlol 8y ago
Passport numbers are the easiest and perhaps the only way for these hotels to uniquely identify and track their customers. A ton of jurisdictions also require hotels to store these.
- maxerickson 8y ago
  So which hotels limit their storage to the legal requirements?
  - ryanlol 8y ago
    Do not stay in any hotels if you do not want your personal information collected and shared with various third parties. Airbnb and similar tend to be vastly friendlier to privacy-conscious travelers, usually collecting less than legally required (they also do a very bad job of verifying what they do collect).
    - ghaff 8y ago
      Well, with Airbnb, you're presumably registered on the site and have a credit card on file which is how you pay. In general (at least in the US), lower-end independent motels and the like will often be less rigorous about checking ID and will probably let you pay cash.
      - ryanlol 8y ago
        You can acquire a relatively anonymous prepaid card and use that to pay airbnb. Also, at least the last time I tried their ID verification thing didn't care about the name on the ID so you could just use any random ID from wikileaks to verify your account. Yeah, in the US the hotel situation tends to be significantly better than in the EU.
        ghaff 8y ago
        Good point about prepaid cards. Like anything of this nature, a lot depends on who you're hiding from and why. It's one thing to thwart generic big corporation knowing where you've been and what you've bought. It's another to be hiding from someone who has some degree of access to your computer and financial accounts. It's still another to be actively hiding from individuals or entities with varying degrees of law enforcement authority and varying degrees of interest in tracking you down.
jlmorton 8y ago
It's a government requirement in many jurisdictions, including much of Asia and the EU. Note that in the EU, at least, the data is not sent to the government authorities, but it must be available to them.
- cr0sh 8y ago
  So do those jurisdictions provide passports for free (or very low cost) and/or make them easy to acquire? In the US to get a passport isn't an arduous process, but it isn't easy nor cheap; when I got mine done (full thing - card and actual passport), I had to first get a passport photo taken and paid for (walgreens), then go to a local courthouse during a weekday (which I had to take off the time for), then pay a bunch of money (oh - and I had to give them my birth certificate and some other ID - which I got back when I received my passport weeks later) - then wait. I think there were fingerprints involved too... Anyhow - it wasn't an easy or cheap process, but I can understand why they make it that way. But for most people in the US, unless they travel internationally, they never obtain a passport, because of this process. It is only set up for people who can afford it (both in time and money). So - if it is a requirement in other areas of the world, then receiving or obtaining a passport would have to be made easier for those who couldn't afford the time or money; time could be made by legislation making employers provide time for doing such a thing, and/or keeping courts or wherever to process the applications open on weekends or have later hours or something. Of course - we are talking about "non-US" places, which seem to have far saner social policies under which this would fall...
  - andylynch 8y ago
    At least in the EU/EEA, most countries have national ID cards, and you can travel with those instead.
  - Karliss 8y ago
    Don't know about other EU countries but here everyone older than 15 years is required to have a passport or id card by law. The fee is ~1/4 of what it costs in US. You don't need to make a photo before as it can be taken during application. If you don't want to wait in queue it is possible to make an appointment by phone.
chrisseaton 8y ago
> What does a hotel organization do with it? It's a requirement for hotels to have passport numbers in many jurisdictions. Have you never used a hotel before?
- kyoob 8y ago
  Yes I have used a hotel before.
  - deleted 8y ago
    [deleted]
- jandrese 8y ago
  If you are in-country you can use an in-country ID instead--drivers license number most often. I've never had a hotel ask for my passport when traveling in the US as an American for example. I'm sure they would take it if I offered, but my drivers license is considered sufficient.

sneakernets 8y ago

Is anyone surprised that assigning numbers to people to identify them seems to backfire every time it's tried?

ngneer 8y ago
Numbers have to be assigned in order to break the symmetry. Otherwise how would you tell humans apart?
- politician 8y ago
  Coarsely, the reason for the need to tell humans apart is to assign debts.
  - pkaye 8y ago
    Would you be fine having your medical history mixed with someone else with the same name?
    - drewmol 8y ago
      Yes, I would even be willing to pay a small fee for this. (not the op)
      - politician 8y ago
        (op here) The premise of the grandparent is an illusion that depends on the idea that somehow a medical provider (which one?) is a better caretaker for your medical history than you are. In the cases where that is actually true, power of attorney is the real solution -- not EMR records hosted offsite by 3rd party vendors in 3rd world countries on behalf of one or more hospitals. How absurd. My medical history is mine; it's ultimately not yours. If you need my medical history, allow me to give you limited access to it. Now, if your billing is opaque and you're playing shenanigans with the insurance companies about who owes what, then sure, you need my Passport, SSN, DNA, Real ID, and biometrics -- and you should probably hold my medical history hostage too -- to make sure that you can collect on the debt.

pasbesoin 8y ago

It seems law and regulation are going to have to clearly define and constrain what these organizations are allowed to collect and what they are not allowed to collect -- or, rather, that everything else is off-limits. Guests need to be offered the question of whether they care to share X data, and guaranteed that a "no" answer will not affect their ability to do business and receive services in the slightest -- nor the price they receive. Many people scream bloody murder WRT regulation. However, here we have a clear and repeated industry failure -- one with significant knock-on costs and risks. So, tough. You failed. I could also cough up a protest on my part against the whole misleading notion of "self-regulation". And point out that in an era of increasing consolidation into brands under very few and very large holding companies, effective competition -- including and with respect to data and security practices -- is largely absent. P.S. Where data collection is required, standards and aggressive auditing should be funded and enforced. People in the U.S. generally seem to have no problem with FDA regulation and inspection of meat production. (Not realizing how industry political initiatives continue to stress and periodically threaten this, e.g. inspection budgets.) Well, it seems we're to the point of needing and FDA for data, or something like. I say this with trepidation. And any initiative should come with a healthy dose of "audit the auditor", to keep requirements and process transparency to a maximum and minimize the governments' own carve-outs and attempts to siphon off the data whose processing are under inspection. Back to my accounting days. How do you prevent mistakes, error, and fraud? Well, orthogonal processes with robust cross-checks certainly help.

true_religion 8y ago
With regards to EU law, hotels are required to keep the passport numbers of foreign national guests on file.
jstanley 8y ago
The only reason the hotels are collecting passport numbers in the first place is because of regulations requiring them to.
- lotsofpulp 8y ago
  It also helps verify against people causing damage to the hotel. Business where the transaction is not a simple "seller provides item - buyer pays seller" have different risks involved, and therefore need to additional measures to protect against them. Requiring credit cards, government issued photo ID, age over 21 are all methods of preventing guests who trash rooms, sneak in pets and cause noise disturbances, underage partiers, pimps and hookers, drug dealers, excessively dirty and causing pest problems etc from messing up the business. Same with car rentals and flights. Some people are problematic, and it affects other customers, and you need a way to mitigate the problem. In the US, almost all local ordinances require hotel operators to keep track of who is staying in which room for a year or so (some even require photocopying, although that's not always followed), and to hand over that info to police whenever they demand it.

40acres 8y ago

I would've thought by now the security consultant industry would be really robust and large corporations like Marriott would be advised to handle low hanging fruit like "encrypt everything". Anyone know the current state of the industry?

munchbunny 8y ago
I think this blog post from Brian Krebs captures the problem pretty well: https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/ https://krebsonsecurity.com/2018/12/a-chief-security-concern... There's a lack of attention at the executive and organization levels in these major corporations, so they're not set up to deal with security threats in a forward looking way.
ganoushoreilly 8y ago
The industry is robust, companies just refuse to spend money on security because the risks aren’t all that great to them and insurance policies are paid out regardless.
- jlgray 8y ago
  I'm ever so slightly optimistic in this regard. As soon as we see a few GDPR-related penalties assessed, the risk-reward calculation will change drastically. According to their 2017 annual report [1], Marriot had $22.9bn in worldwide revenue. A 4% penalty on that would be $900M. [1] https://marriott.gcs-web.com/static-files/057a8e1a-a5c5-4c20-a51c-0b20bf8a0bc1 https://marriott.gcs-web.com/static-files/057a8e1a-a5c5-4c20...
  - reaperducer 8y ago
    I read that there was some kind of grace period involving GDPR penalties. Has the EU handed out any fines yet, or is it still letting companies adjust?
    - qznc 8y ago

awat 8y ago

Needs to be substantial penalties for these transgressions or it's just another "cost of doing business".

ascorbic 8y ago
A lot of these are likely to have been from EU residents, so there certainly could be some very large fines coming their way, courtesy of the GDPR.
- alkonaut 8y ago
  Wow, I didn’t think about that - it applies to EU citizens even when not in the EU. And for a few types of business you have to have physical presence where you operate (hotels is one) so the EU can always force Marriott to pay up or extort the money from their business in the EU.

madeuptempacct 8y ago

Heh. A dev at work pushed our Azure cloud key to GitHub two days ago. A day ago we got a $250,000 bill for hundreds of virtual machines running at full capacity. Silly hackers.

throwaway456321 8y ago

Marriott. A bunch of tossers.

IshKebab 8y ago

What can malicious people do with my passport number?

jandrese 8y ago
Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus.
- ghaff 8y ago
  Not that one wants this sort of information to be leaked of course, but it's hard to see information that is routinely copied by hotel desk clerks and which is written down on countless forms is deeply sensitive information that will cause dire outcomes if it gets out.
  - coltonv 8y ago
    You mean like your bank account number, which is constantly typed into online forms of all sorts of websites. Or your credit card number, which you probably say verbally into the phone to pay your bills? Truth is, lots of extremely sensitive data exists in insecure states all the time.
    - ghaff 8y ago
      For that matter, your bank account number goes on pieces of paper called checks that many of us give to individuals and companies all the time to pay bills. So, yes, I draw a distinction between numbers that we hand out willy-nilly and truly sensitive information. There's a big difference between my checking account number and my health records.
- ryanlol 8y ago
  >Create a fake passport to travel under your name and commit crimes. Try not to be surprised when you discover an arrest warrant in your name for sex trafficking in Belarus This would only require a name, not a passport number. A passport number would simply be of no use here, there doesn't exist any¹ automated mechanism for Belarus to verify foreign passport numbers. ¹Well OK, with biometric passports it is possible to cryptographically verify some data.

fatjokes 8y ago

Will they be penalized? Was Equifax ever penalized? The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job. Marriott currently has no incentive to spend money to do a good security audit. They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.

robin_reala 8y ago
Given that they have EU customers I imagine that yes, they’ll be penalised.
- GordonS 8y ago
  GDPR is very recent - do we know exactly when the compromise was? If it was before GDPR came in, they might be able to weasel out of any potential penalty.
  - walshemj 8y ago
    And logging passports of foreign visitors is the norm in the EU - I suspect the national security exemption would apply - be interesting what the European court of justice would say if asked.
    - hadrien01 8y ago
      Exemption for being allowed to store them is arguable, but they could still be prosecuted under data protection.
    - rue 8y ago
      I would not imagine even the legal requirement would reduce the safeguarding requirements nor allow an increase to the necessary retention period.

ex3ndr 8y ago

Curious question. How they could encrypt this information when managers at help desks in the hotels need that information, say, for verification? Isn't it steal password from temporary worker will be super easy anyway?

diminoten 8y ago
You can decrypt the encrypted info, which is what you want to do with PII at rest, which I'm assuming is where the data was taken.

embwbam 8y ago

If you’re doing a new startup, and have aggressive timelines, what security measures would you implement to protect PII from day 1? I’m an experienced dev but not a security expert.

thinkingemote 8y ago
I'd suggest hiring an expert, assuming the startup is funded
ummonk 8y ago
Two factor authentication for all developer accounts, require TLS 1.2 to access the website and add HSTS, have some system for ensuring all SQL queries are sanitized, use bcrypt or scrypt with recommended settings to hash user passwords, add a content-security policy, enable secure and same-site attributes for cookies, as well as http-only, and add a double-submit csrf token. That should cover the basics to start with, in rough order of priority, assuming you're building a web app. Also, in general, be conservative about what PII you collect; hackers can't steal information you don't have.

wdn 8y ago

Until someone is held responsible, big corporations would not care about customer's data. It probably cheaper to give everyone a year of credit monitor (which not everyone used) than implement security to protect customer's data. This data breach is reporting every week, yet nothing is being done.

jliptzin 8y ago

Any data we turn over to companies should be treated as compromised. There should be a way to issue new SSNs. Things that can’t be changed like birthdays, addresses, and last names shouldn’t be stored by companies without very good reason.

anonymous5133 8y ago

Why does Marriott have passport numbers to begin with? This really comes down to companies simply collecting way too much information. Consumers need to push back against this type of data collection. Only give information which is clearly required for their business and nothing more. Also the companies should only retain that information for long enough to conduct their business.

seattle_spring 8y ago
A lot of countries require hotels to collect information that proves that the guest is there legally.
- hiccuphippo 8y ago
  In my country hotels are even required to make a photocopy of the passport/id when a Traveller checks in. Having your id being public is not more of a security issue than your name being public.
confounded 8y ago
This is really the nub of the issue. I love that when I’m traveling for business everything is arranged for me, but I hate that I get put in situations where I’m booked into big hotels with policies like this. Increasingly it seems like there should be some kind of regulation that (with exceptions) if a good or service costs money, you should be able to buy it in exchange for money, and refuse to provide personal information even if requested.
- ghaff 8y ago
  It's often required by the government where the hotel is located.

ummonk 8y ago

Note that encryption at rest isn't a panacea. Since every system that accesses the data needs to have the decryption key, if the hacker is getting the data by hacking one of those systems, then the encryption at rest has achieved nothing.

r00fus 8y ago
> then the encryption at rest has achieved nothing That's a bit of an overreaction. It has at least guaranteed that the intruder has active keys on a relevant system that can access the data. It ups the ante with reasonable/minimal cost. Encryption at rest is a defense-in-depth approach allowing you to be sure that e.g. some random stolen backup image (perhaps of a 3rd party system) doesn't expose your etc/shadow or user tables for subsequent rainbow-table attacks.
germainelong 8y ago
This is so short sighted I can't believe you are serious and not trolling. Every precaution has its limitations but why give the attackers a free meal? Encrypted data protects from simple theft or loss of the device so a common thief won't leak the data.
- ummonk 8y ago
  You seem to be arguing against something I never implied. I said it's not a panacea. Do you disagree?
  - germainelong 8y ago
    You implied that encryption is optional whereas this shouldn't even be a discussion.
scosman 8y ago
Not a panacea, but always required. All disks eventually are thrown out. It doesn't prevent all attacks, but it's the only way to prevent a very common class of attack.

hiccuphippo 8y ago

Why is having a person's passport number a security issue in the first place? What could a malicious person do if they have your passport number?

scarlac 8y ago
Unfortunately passport number is considered semi-secret to the point where you can retrieve very personal information with it or with a tiny amount of extra info such as last name + passport number. Passport numbers are also permanent, until replaced. Or to put simply: Passport numbers make identify theft easier.

mephistosec 8y ago

Nothing was 'lost'. A misplaced laptop is lost; records from a database are accessed (or 'stolen', but I think that's problematic as well). The fact that the access was possible says nothing about the hackers and everything to do with Marriott's security approach and posture. Can we please stop letting companies hand-wave away these attacks and stop solely blaming hackers? I've worked with hundreds of companies' security teams. While I've seen a select few companies do a really great job, most were either negligent, incompetent, or both. I'm sick of the blame for this being laid solely at the feet of the abstract "hackers", rather than the people who make these attacks utterly trivial. (Posted from a throwaway because Marriott may or may not be a customer of mine. Ugh.)

germainelong 8y ago

Companies should not be allowed to have such sensitive data or the punishment should be severe - I mean the entire board should look at doing time. Currently as the law is, the rich can just laugh and carry on.

davidf18 8y ago

I am confused. Is there a way to check on-line about whether passport was compromised? Also, it doesn't make any sense to wait for an accident to happen -- it is better to replace the passport before there can be any fraud.

miohtama 8y ago

They will be punished in European Union where they have business presence. They had EU passports there. Under GDPR negligence is punishable. UK ICO hopefully will intervene in few months. In USA remedy actiona are class action lawsuit driven and corporations do not have incentive to change their behaviour.

alltakendamned 8y ago

Now chant with me... GDPR... GDPR... GDPR...

jarjoura 8y ago

Throughout my travels my passport number has been copied with an old school copier, entered into excel spreadsheets and held on to by various shops for collateral. Not saying this isn’t a shitty hack, but I feel like the passport is the least secured document attached to me I have.

linkmotif 8y ago
I thought you should never, ever give your passport to anyone, especially for collateral. Right?
- ryanlol 8y ago
  Dunno, depending on your country they can be pretty easy to replace and they do tend to work quite well as collateral. This entirely depends on your situation, for example I don't think there are many places where it'd be a huge deal for a white westerner to lose their passport.
  - Quanttek 8y ago
    Are you sure you're not conflating IDs with passports? Though, yeah, in Germany at least it's quite easy to replace passports

myrandomcomment 8y ago

Uh, was in China more the once so I think if they are responsible it is not something they do not have ;) I think I have become numb to this stuff. I just assume it’s all out there and thus keep an eye on my credit reports, et.al. I am more pissed about the basic level of OPsec I see at these companies. I am even more worried about the same thing at our Defence contractors and related companies.

deleted 8y ago

[deleted]

amrx431 8y ago

And to which software sweatshop was the IT out sourced to ?

alexeiz 8y ago

I logged into Marriott to change my password... and I couldn't. Their web page responsible for changing password times out. What kind of POS system is that?

zachberger 8y ago
Seems like you've been out of the loop. They've been experiencing massive computer problems since August. https://www.wsj.com/articles/inside-the-marriott-starwood-loyalty-program-turbulence-1543416010 https://www.wsj.com/articles/inside-the-marriott-starwood-lo...