6 ms·

Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records

76 points by dthal 13y ago

PeterisP 13y ago
Perhaps it's time to finally attack the source of USA's ID theft problem instead of trying to hide the unhideable? This is a problem mostly limited to USA and just a few other countries. In most places worldwide such an information leak could be used at best for marketing/spam targeting, not for stealing money through ID theft. The differences are mainly in legislation and liability, which then get reflected in policies of credit institutions that make it much less viable and thus much less widespread. To put it simply, the information that, say, your spouse or mother would know should not be enough to get credit in your name, bill expensive services to you or gain access to your accounts. If some lender gets duped by their negligence to check who you are, then they got defrauded and it should stay as their problem - mostly to motivate them to put actual effort into preventing this.
- Casseres 13y ago
  > To put it simply, the information that, say, your spouse or mother would know should not be enough to get credit in your name, bill expensive services to you or gain access to your accounts. Agreed. I hear too many stories of ex-wifes opening up credit cards in their husbands' name when going through divorce proceedings. Second to that, I hear quite a few stories of deadbeat parents opening credit cards in their children's name (once they turn 18) and racking up massive debt without even telling them about it.
- josephlord 13y ago
  The whole name "identity theft" is blame and victim shifting. It is "bank fraud" or more generally "credit fraud".
- duncans 13y ago
  "No, you see, it was your identity ... they said they were you." "And you believed them?" "Yes they stole your identity." "Well, I don't know because I think I have my identity, whereas you seemed to have lost several thousands of pounds..." http://www.youtube.com/watch?v=CS9ptA3Ya9E http://www.youtube.com/watch?v=CS9ptA3Ya9E
- mmcnickle 13y ago
  Ross Anderson sums this up nicely in "Security Engineering": "I write ‘identity theft’ in quotes as it’s a propaganda term for the old-fashioned offence of impersonation. In the old days, if someone went to a bank, pretended to be me, borrowed money from them and vanished, then that was the bank’s problem, not mine. In the USA and the UK, banks have recently taken to claiming that it’s my identity that’s been stolen rather than their money, and that this somehow makes me liable. So I also parenthesise ‘victims’ — the banks are the real victims, except insofar as they commit secondary fraud against the customer."
BIair 13y ago
"Ngo’s ID theft business attracted more than 1,300 customers who paid at least $1.9 million between 2007 and Feb. 2013 to look up Social Security numbers, dates of birth, addresses, previous addresses, phone numbers, email addresses and other sensitive data"
spacehome 13y ago
The focus of a lot of the coverage of this recent string of high-profile ID thefts has been the security of the companies in question, but I think the real fundamental problem of our system is that in order to prove your identity to someone you have to give them enough information that they can impersonate you to a third party. Information like SSN, address, mother's maiden name, driver's license number, etc. is simultaneously proof of identity and "private". Credit card numbers and checking accounts have basically the same flaw. All a merchant needs to pull money out of your account is the account number and some pretty basic additional information. If you write someone a check for a penny, you've given them enough info to drain the account. What we really need is a complete overhaul of how we prove identity. Identities should be linked to public-key/private-key pairs so you can prove you are who you say you are by signing a nonce, and thus others won't be able to impersonate you just by hacking a third party. Similarly, monetary transactions should be signed by both the sender and the recipient and include amount, date, memo, etc.. (Seriously, who initially thought that recipient-initiated transactions with no sender involvement wasn't going to be abused?)
- icebraining 13y ago
  Well, here in Portugal - and I know there are other European countries doing the same - our national ID cards already include a public/private key pair and can encode and sign stuff using standard APIs. You can already login on some governmental websites (e.g. IRS) using it. That said, I worry about having a single, State-granted identity; there's a reason why assigning a single number to each citizen that links all their records (health, criminal, etc) is unconstitutional here. I wish we could have a vouching system instead, where people and organizations could certify they do business with identity X. Something like Convergence[1] but for people instead of websites. [1] http://en.wikipedia.org/wiki/Convergence_(SSL) http://en.wikipedia.org/wiki/Convergence_(SSL)
  - Spearchucker 13y ago
    This problem has been solved. The idea is to use identity federation, claims-based authorisation, and a privacy-enhancing technology that lets the subject determine which claims to share with a resource provider. Such a system can verify identity without divulging that identity. For instance, when you buy beer you need to prove you're over 18. The barman doesn't need to know your name, address, what vehicle classes you're licensed to drive, or age. All the barman needs is to know that you're over 18. The reason nobody uses it is that it's unpalatable to identity and resource providers alike. Imagine a world where you could buy anything without the seller ever knowing who you are. Or your bank not knowing what you bought. Or your identity provider (government) not knowing where you're using your authN credential. The tech community doesn't like it because even though it's open source, it's from Microsoft. And that it uses XML. So we keep on using broken identity systems like Persona and OAUTH. http://research.microsoft.com/en-us/projects/u-prove/ http://research.microsoft.com/en-us/projects/u-prove/
deleted 13y ago
[deleted]
mschuster91 13y ago
"Ngo was arrested last year in Guam by U.S. Secret Service agents after he was lured into visiting the U.S. territory to consummate a business deal with a man he believed could deliver huge volumes of consumers’ personal and financial data for resale." And now the poor schmuck is being tried in the US for crimes committed on Vietnamese soil. Not that I would dislike grilling that guy in court, but that is just plain wrong. He did not do anything wrong on US soil so he should not be tried in the US, but Vietnam instead. Funny how Americans always believe they're the world police.
- bitJericho 13y ago
  Too bad he didn't live in New Zealand.
- lostcolony 13y ago
  This is a crime that explicitly takes place across country borders. You're saying that the trial should take place in the perpetrator's country, rather than the victims' country. Why do you assume that is somehow more just? Note that I'm not saying it should be, just that it's a sufficiently complex issue that to just be dismissive, "Oh, there America goes again, being the world police" seems to miss the fact that the millions of victims of this persons actions are all in the US.
  - mschuster91 13y ago
    If I murder someone while traveling in the US, I can expect to be trialed there (because I committed the crime on US soil). If I murder someone in Germany, I can expect to be trialed by a German jury, under German laws and standards. Same goes for every crime. Trialing people in foreign jurisdictions deprives them of their basic rights which a "resident" would get - like the right to be trialed by a jury of local people, for example. Not to mention language barriers and the exorbitant costs of legal defense in the US compared to Vietnam!
    - edent 13y ago
      Suppose you're standing on the border of Germany and France. You fire a gun on the German side and kill someone on the French side. In which country should you be tried?
kyboren 13y ago
Some day, people will wake up and realize that all aggregation of data on citizens and consumers–including implicit aggregation, where information is only transiently collected–by governments, data brokers, retailers, or anyone else only makes the inevitable compromise that much more damaging. Today’s highly connected world has ushered in an era with new hidden risks along with the obvious new opportunities. We’re woefully unprepared for these risks when policymakers don’t even know what an ISP is. Time and time again we see appalling breaches of massive repositories of private information, and time and time again we see our politicians and corporate leaders stick their heads in the sand and ignore the root cause. What’s needed is a new paradigm, where data aggregation is outlawed, and where decentralization and previously-fantastic cypherpunk ideas for cryptographic identity verification, blinded signatures, provably-anonymous digital cash systems, and the like become standard. PCI or HIPAA compliance will simply never be enough. Where cryptography can be used to protect individual privacy while providing strong authentication, it must. Where it (yet) cannot, information decentralization is the only way to mitigate the inherent privacy risks. Unfortunately, I worry that a combination of policymakers’ lack of insight, corporate leaders’ pursuit of cost reduction, and “Big Data’s” (or, more aptly, “digital anal rapists’”) penchant for massive warehouses of private information will prevail and ensure the fundamental reforms we need will never see the light of day.
viraptor 13y ago
I'm not surprised it's Experian. Maybe it wasn't their fault, but only interaction I had with them was: "how do I provide my documents in a secure way?", "here's a pre-paid standard class envelope, just stick a copy of your utility bills, passport, driving licence inside and send it to us". They're absolutely irresponsible with people's documents and data, at least here in the UK.

76 points by dthal 13y ago

Perhaps it's time to finally attack the source of USA's ID theft problem instead of trying to hide the unhideable? This is a problem mostly limited to USA and just a few other countries. In most places worldwide such an information leak could be used at best for marketing/spam targeting, not for stealing money through ID theft. The differences are mainly in legislation and liability, which then get reflected in policies of credit institutions that make it much less viable and thus much less widespread. To put it simply, the information that, say, your spouse or mother would know should not be enough to get credit in your name, bill expensive services to you or gain access to your accounts. If some lender gets duped by their negligence to check who you are, then they got defrauded and it should stay as their problem - mostly to motivate them to put actual effort into preventing this.

Casseres 13y ago
> To put it simply, the information that, say, your spouse or mother would know should not be enough to get credit in your name, bill expensive services to you or gain access to your accounts. Agreed. I hear too many stories of ex-wifes opening up credit cards in their husbands' name when going through divorce proceedings. Second to that, I hear quite a few stories of deadbeat parents opening credit cards in their children's name (once they turn 18) and racking up massive debt without even telling them about it.
josephlord 13y ago
The whole name "identity theft" is blame and victim shifting. It is "bank fraud" or more generally "credit fraud".
duncans 13y ago
"No, you see, it was your identity ... they said they were you." "And you believed them?" "Yes they stole your identity." "Well, I don't know because I think I have my identity, whereas you seemed to have lost several thousands of pounds..." http://www.youtube.com/watch?v=CS9ptA3Ya9E http://www.youtube.com/watch?v=CS9ptA3Ya9E
mmcnickle 13y ago
Ross Anderson sums this up nicely in "Security Engineering": "I write ‘identity theft’ in quotes as it’s a propaganda term for the old-fashioned offence of impersonation. In the old days, if someone went to a bank, pretended to be me, borrowed money from them and vanished, then that was the bank’s problem, not mine. In the USA and the UK, banks have recently taken to claiming that it’s my identity that’s been stolen rather than their money, and that this somehow makes me liable. So I also parenthesise ‘victims’ — the banks are the real victims, except insofar as they commit secondary fraud against the customer."

BIair 13y ago

"Ngo’s ID theft business attracted more than 1,300 customers who paid at least $1.9 million between 2007 and Feb. 2013 to look up Social Security numbers, dates of birth, addresses, previous addresses, phone numbers, email addresses and other sensitive data"

spacehome 13y ago

The focus of a lot of the coverage of this recent string of high-profile ID thefts has been the security of the companies in question, but I think the real fundamental problem of our system is that in order to prove your identity to someone you have to give them enough information that they can impersonate you to a third party. Information like SSN, address, mother's maiden name, driver's license number, etc. is simultaneously proof of identity and "private". Credit card numbers and checking accounts have basically the same flaw. All a merchant needs to pull money out of your account is the account number and some pretty basic additional information. If you write someone a check for a penny, you've given them enough info to drain the account. What we really need is a complete overhaul of how we prove identity. Identities should be linked to public-key/private-key pairs so you can prove you are who you say you are by signing a nonce, and thus others won't be able to impersonate you just by hacking a third party. Similarly, monetary transactions should be signed by both the sender and the recipient and include amount, date, memo, etc.. (Seriously, who initially thought that recipient-initiated transactions with no sender involvement wasn't going to be abused?)

icebraining 13y ago
Well, here in Portugal - and I know there are other European countries doing the same - our national ID cards already include a public/private key pair and can encode and sign stuff using standard APIs. You can already login on some governmental websites (e.g. IRS) using it. That said, I worry about having a single, State-granted identity; there's a reason why assigning a single number to each citizen that links all their records (health, criminal, etc) is unconstitutional here. I wish we could have a vouching system instead, where people and organizations could certify they do business with identity X. Something like Convergence[1] but for people instead of websites. [1] http://en.wikipedia.org/wiki/Convergence_(SSL) http://en.wikipedia.org/wiki/Convergence_(SSL)
- Spearchucker 13y ago
  This problem has been solved. The idea is to use identity federation, claims-based authorisation, and a privacy-enhancing technology that lets the subject determine which claims to share with a resource provider. Such a system can verify identity without divulging that identity. For instance, when you buy beer you need to prove you're over 18. The barman doesn't need to know your name, address, what vehicle classes you're licensed to drive, or age. All the barman needs is to know that you're over 18. The reason nobody uses it is that it's unpalatable to identity and resource providers alike. Imagine a world where you could buy anything without the seller ever knowing who you are. Or your bank not knowing what you bought. Or your identity provider (government) not knowing where you're using your authN credential. The tech community doesn't like it because even though it's open source, it's from Microsoft. And that it uses XML. So we keep on using broken identity systems like Persona and OAUTH. http://research.microsoft.com/en-us/projects/u-prove/ http://research.microsoft.com/en-us/projects/u-prove/

deleted 13y ago

[deleted]

mschuster91 13y ago

"Ngo was arrested last year in Guam by U.S. Secret Service agents after he was lured into visiting the U.S. territory to consummate a business deal with a man he believed could deliver huge volumes of consumers’ personal and financial data for resale." And now the poor schmuck is being tried in the US for crimes committed on Vietnamese soil. Not that I would dislike grilling that guy in court, but that is just plain wrong. He did not do anything wrong on US soil so he should not be tried in the US, but Vietnam instead. Funny how Americans always believe they're the world police.

bitJericho 13y ago
Too bad he didn't live in New Zealand.
lostcolony 13y ago
This is a crime that explicitly takes place across country borders. You're saying that the trial should take place in the perpetrator's country, rather than the victims' country. Why do you assume that is somehow more just? Note that I'm not saying it should be, just that it's a sufficiently complex issue that to just be dismissive, "Oh, there America goes again, being the world police" seems to miss the fact that the millions of victims of this persons actions are all in the US.
- mschuster91 13y ago
  If I murder someone while traveling in the US, I can expect to be trialed there (because I committed the crime on US soil). If I murder someone in Germany, I can expect to be trialed by a German jury, under German laws and standards. Same goes for every crime. Trialing people in foreign jurisdictions deprives them of their basic rights which a "resident" would get - like the right to be trialed by a jury of local people, for example. Not to mention language barriers and the exorbitant costs of legal defense in the US compared to Vietnam!
  - edent 13y ago
    Suppose you're standing on the border of Germany and France. You fire a gun on the German side and kill someone on the French side. In which country should you be tried?

kyboren 13y ago

Some day, people will wake up and realize that all aggregation of data on citizens and consumers–including implicit aggregation, where information is only transiently collected–by governments, data brokers, retailers, or anyone else only makes the inevitable compromise that much more damaging. Today’s highly connected world has ushered in an era with new hidden risks along with the obvious new opportunities. We’re woefully unprepared for these risks when policymakers don’t even know what an ISP is. Time and time again we see appalling breaches of massive repositories of private information, and time and time again we see our politicians and corporate leaders stick their heads in the sand and ignore the root cause. What’s needed is a new paradigm, where data aggregation is outlawed, and where decentralization and previously-fantastic cypherpunk ideas for cryptographic identity verification, blinded signatures, provably-anonymous digital cash systems, and the like become standard. PCI or HIPAA compliance will simply never be enough. Where cryptography can be used to protect individual privacy while providing strong authentication, it must. Where it (yet) cannot, information decentralization is the only way to mitigate the inherent privacy risks. Unfortunately, I worry that a combination of policymakers’ lack of insight, corporate leaders’ pursuit of cost reduction, and “Big Data’s” (or, more aptly, “digital anal rapists’”) penchant for massive warehouses of private information will prevail and ensure the fundamental reforms we need will never see the light of day.

viraptor 13y ago

I'm not surprised it's Experian. Maybe it wasn't their fault, but only interaction I had with them was: "how do I provide my documents in a secure way?", "here's a pre-paid standard class envelope, just stick a copy of your utility bills, passport, driving licence inside and send it to us". They're absolutely irresponsible with people's documents and data, at least here in the UK.