Language Selection

English French German Italian Portuguese Spanish

Data Theft: How to Fix the Mess

Filed under
Security

IN the early 1970's, Senator William Proxmire, the Wisconsin Democrat who was the scourge of the banking industry, decided something needed to be done about the chaotic state of the credit card business.

Credit cards were still relatively new, and all over the country, banks were peppering Americans with unsolicited cards - sending them not only to the heads of households, but to their children, their dogs and their dead grandmothers. Thieves would follow the postman doing his rounds, steal cards out of mailboxes and use them. People were being billed for things they'd never bought with cards they'd never asked for - and the banks were demanding payment. Even though the banking industry insisted that only a small minority of transactions were fraudulent, the public outcry was enormous.

Here's what Mr. Proxmire did. First, in 1970, he drafted a bill that banned the practice of "dropping" credit cards on people without their consent. Four years later, he pushed through a bill that limited consumer liability to $50 if a credit card was used fraudulently.

The banking industry was apoplectic as these bills became the law of the land, especially the $50 limit. Why, bank lobbyists complained, should the institutions have to take the hit if a customer was so careless as to have his wallet stolen or credit card snitched? Shouldn't people be responsible for their own actions?

But in time, the banks came to see that it owed Senator Proxmire a debt of gratitude. He hadn't hurt the credit card industry. He had saved it. By forcing the industry to solicit customers, instead of simply dropping cards on them, he gave Americans the feeling that the decision to have a credit card was theirs, not some bank's.

And with the $50 liability limit, people no longer had to fear the dire consequences of having their card stolen. They could embrace credit cards instead of fearing them, which for better or worse they've been doing ever since; there are today over a billion credit cards just in the United States. Over the years, banks and consumers learned to deal with credit card fraud, so that it has become little more than an irritant. Banks don't even demand the $50; they cover the entire loss themselves.

The current "identity theft" crisis, in which we're learning, daily it seems, that institutions like Bank of America, ChoicePoint, Citigroup and many others have allowed our personal financial data to be lost or stolen, is fundamentally an outgrowth of our dependence on credit.

Credit cards are the primary means of buying things on the Internet. Credit card information is what is most often stolen in a data breach case, like the recent CardSystems Solutions fiasco, in which as many as 40 million credit cards may have been compromised. Even in the worst case, when data thieves get enough personal information to impersonate someone electronically, the bad guys usually wind up using that information to establish credit in order to buy things in that person's name.
So when I read the stories about data theft, I can't help thinking back on that credit card crisis of the 1970's. Now, as then, the chances of facing that worst outcome are pretty rare. The vast majority of modern cases classified as identity theft are really just old-fashioned credit card fraud, easily dealt with. (In fact, most of the time, the fraud is committed the old-fashioned way: through the lifting of a wallet.) According to TowerGroup, a financial services consulting firm, only about 160,000 people last year had their financial identities - as opposed to their credit card information, which numbers in the millions - stolen by fraudsters.

Many of the data losses are just that: lost data, not stolen data. The problem isn't even that new; the main reason we are learning about all these cases is a 2003 California law that required, for the first time, that consumers be informed when their personal information was compromised. Before 2003, there were plenty of examples of hacked data. But we didn't hear about those, so we weren't as worried about it.

But so what? In the end, it doesn't matter if the problem isn't new or the risk of being hurt by a data theft is small: the fear is palpable. "In the ChoicePoint case," said Robert Richardson, the editorial director of the Computer Security Institute, "people weren't just uncomfortable that their data was stolen."

"They were also upset to discover that this company that had insufficiently protected their data even had their data."

ChoicePoint is one of those murky "data aggregators," which describes itself as being involved in the "identification, retrieval, storage, analysis and delivery of data." Just reading the description is unsettling.

There is an uneasy sense that people simply do not have control of their own financial information. Most victims of identity theft have no idea how it happened. Their data is out there in the ether of the Internet or on the computers of companies they've never heard of. And if, heaven forbid, they should have their financial identity stolen, the prospect of disaster looms. Is it any wonder that, according to recent surveys by both the Gartner Group and Forrester Research, the percentage of people who say they have stopped using the Internet to pay bills, has risen substantially?

And yet so far, what we've mainly heard is that the onus is on us, the consumer, to become more vigilant. We are told to check our accounts online regularly and to sign up for services that will allow us to monitor our credit rating. True, banks are finally trying to do a better job of securing credit card and other personal data, but there is no legal requirement for them to do so, and there are plenty of bankers who think the problem is overstated.

"Ever since we've had credit, we've had fraud," said Jerry Silva, a TowerGroup analyst. "There is a feeling from the institutions that they've had this problem solved. And there is not a lot of ID theft, which is what all the hullabaloo is about."

Which is why I wish William Proxmire were still on the case. What we need right now is someone in power who can put the burden for this problem right where it belongs: on the financial and other institutions who collect this data. Let's face it: by the time even the most vigilant consumer discovers his information has been used fraudulently, it's already too late. "When people ask me what can the average person do to stop identity theft, I say, 'nothing,' " said Bruce Schneier, the chief technology officer of Counterpane Internet Security. "This data is held by third parties and they have no impetus to fix it."

Mr. Schneier, though, has a solution that is positively Proxmirian in its elegance and simplicity. Most of the bills that have been filed in Congress to deal with identity fraud are filled with specific requirements for banks and other institutions: encrypt this; safeguard that; strengthen this firewall.

Mr. Schneier says forget about all that. Instead, do what Congress did in the 1970's - just put the burden on the financial industry. "If we're ever going to manage the risks and effects of electronic impersonation," he wrote recently on CNET (and also in his blog), "we must concentrate on preventing and detecting fraudulent transactions." And the only way to do that, he added, is by making the financial institutions liable for fraudulent transactions.

"I think business ingenuity is top notch," Mr. Schneier said in an interview. "And I think if you make it their problem, they will solve it."

Yes, he acknowledged, letting consumers off the hook might cause them to be less vigilant. But that is exactly what Senator Proxmire did and to great effect. Forcing the financial institutions to bear the entire burden will cause them to tighten up their procedures until the fraud is under control. Maybe they will invest in complex software. But maybe they'll take simpler measures as well, like making it a little less easy than it is today to obtain a credit card. Best of all, once people see these measures take effect - and realize that someone else is responsible for fixing the problems - their fear will abate.

As Senator Proxmire understood a long time ago, fear is the great enemy of commerce. Maybe this time, the banks will finally understand that as well.

JOSEPH NOCERA
The New York Times

More in Tux Machines

Security Leftovers

  • Security updates for Monday
  • Recursive DNS Server Fingerprint Problem

    Our goal is to identify hijacked resolvers by analyzing their fingerprints, in order to increase safety of Internet users. To do that, we utilize data collected via RIPE Atlas (atlas.ripe.net).

  • Online developer tutorials are spreading XSS and SQL injection flaws

    The researchers, from across three universities in Germany and Trend Micro, checked the PHP code bases of more than 64,000 projects on Github and uncovered more than 100 vulnerabilities that they believe might have been introduced as a result of developers picking up the code that they used from online tutorials.

  • BrickerBot, the permanent denial-of-service botnet, is back with a vengeance

    BrickerBot, the botnet that permanently incapacitates poorly secured Internet of Things devices before they can be conscripted into Internet-crippling denial-of-service armies, is back with a new squadron of foot soldiers armed with a meaner arsenal of weapons.

  • Reproducible Builds: week 104 in Stretch cycle
  • Webroot antivirus goes bananas, starts trashing Windows system files
    Webroot's security tools went berserk today, mislabeling key Microsoft Windows system files as malicious and temporarily removing them – knackering PCs in the process. Not only were people's individual copies of the antivirus suite going haywire, but also business editions and installations run by managed service providers (MSPs), meaning companies and organizations relying on the software were hit by the cockup. Between 1200 and 1500 MST (1800 and 2100 UTC) today, Webroot's gear labeled Windows operating system data as W32.Trojan.Gen – generic-Trojan-infected files, in other words – and moved them into quarantine, rendering affected computers unstable. Files digitally signed by Microsoft were whisked away – but, luckily, not all of them, leaving enough of the OS behind to reboot and restore the quarantined resources.
  • How The Update Framework Improves Security of Software Updates
    Updating software is one of the most important ways to keep users and organizations secure. But how can software be updated securely? That's the challenge that The Update Framework (TUF) aims to solve. Justin Cappos, assistant professor at New York University, detailed how TUF works and what's coming to further improve the secure updating approach in a session at last week's DockerCon 17 conference in Austin, Texas. Simply using HTTPS and Transport Layer Security (TLS) to secure a download isn't enough as there have been many publicly reported instances of software repositories that have been tampered with, Cappos said.
  • Security Updates for Ubuntu Phone to End in June
    Security updates for Ubuntu phone and tablet will end this June, Canonical has confirmed. Current OTA updates are currently limited to critical fixes and security updates — a decision we were first to tell you back in January. But after June 2017 Canonical “will no longer deliver any further updates”.
  • Canonical to stop supporting Ubuntu Phone in June
    Canonical had already announced development of its Ubuntu Phone software was ending. Now we know when the final nail goes in the coffin: June.
  • Malware Hunts And Kills Poorly Secured Internet Of Things Devices Before They Can Be Integrated Into Botnets
    Researchers say they've discovered a new wave of malware with one purpose: to disable poorly secured routers and internet of things devices before they can be compromised and integrated into botnets. We've often noted how internet-of-broken-things devices ("smart" doorbells, fridges, video cameras, etc.) have such flimsy security that they're often hacked and integrated into botnets in just a matter of seconds after being connected to the internet. These devices are then quickly integrated into botnets that have been responsible for some of the worst DDoS attacks we've ever seen (including last October's attack on DYN).

GNOME/GTK News

  • The Way GNOME Handles Wallpapers Really Annoys Me
    I love GNOME Shell — and no, not just because I’ve little choice now that is Ubuntu’s default desktop! But the more I use GNOME the more I learn that the desktop environment, like every other, has its own share of quirks, bugs and inconsistencies. Like the following appreciably niche niggle in the the way GNOME handles desktop wallpapers.
  • Drag-and-drop in lists
    I’ve recently had an occasion to implement reordering of a GtkListBox via drag-and-drop (DND). It was not that complicated. Since I haven’t seen drag-and-drop used much with list boxes, here is a quick summary of what is needed to get the basics working.

Containers News

  • How Kubernetes is making contributing easy
    As the program manager of the Kubernetes community at Google, Sarah Novotny has years of experience in open source communities including MySQL and NGINX. Sarah sat down with me at CloudNativeCon in Berlin at the end of March to discuss both the Kubernetes community and open source communities more broadly. Among the topics we covered in the podcast were the challenges inherent in shifting from a company-led project to a community-led one, principles that can lead to more successful communities, and how to structure decision-making.
  • How Microsoft helped Docker with LinuxKit and Moby Project [Ed: Microsoft 'helped'... embrace, extend, coerce; haven't Docker employees learned from history?]
    Today, supporting Linux is as critical to Microsoft as it is to Red Hat and SUSE.
  • How to make branding decisions in an open community
    On April 18, Docker founder Solomon Hykes made a big announcement via a pull request in the main Docker repo: "Docker is transitioning all of its open source collaborations to the Moby project going forward." The docker/docker repo now redirects to moby/moby, and Solomon's pull request updates the README and logo for the project to match. Reaction from the Docker community has been overwhelmingly negative. As of this writing, the Moby pull request has garnered 7 upvotes and 110 downvotes on GitHub. The Docker community is understandably frustrated by this opaque announcement of a fait accompli, an important decision that a hidden inner circle made behind closed doors. It's a textbook case of "Why wasn't I consulted?"

Ubuntu 17.04: Unity's swan song?

For the most part, not much has changed on Ubuntu's Desktop edition in the past year. Unity 7 has more or less remained the same while work was progressing on the next version of the desktop, Unity 8. However, now that both desktops are being retired in favour of the GNOME desktop, running Ubuntu 17.04 feels a bit strange. This week I was running software that has probably reached the end of its life and this version of Ubuntu will only be supported for nine months. I could probably get the same desktop experience and most of the same hardware support running Ubuntu 16.04 and get security updates through to 2021 in the bargain. In short, I don't think Ubuntu 17.04 offers users anything significant over last year's 16.04 LTS release and it will be retired sooner. That being said, I could not help but be a little wistful about using Unity 7 again. Even though it has been about a year since I last used Unity, I quickly fell back into the routine and I was once more reminded how pleasant it can be to use Unity. The desktop is geared almost perfectly to my workflow and the controls are set up in a way that reduces my mouse usage to almost nothing. I find Unity a very comfortable desktop to use, especially when application menus have been moved from the top panel to inside their own windows. While there are some projects trying to carry on development of Unity, this release of Ubuntu feels like Unity's swan song and I have greatly enjoyed using the desktop this week. While there is not much new in Ubuntu 17.04, the release is pretty solid. Apart from the confusion that may arise from having three different package managers, I found Ubuntu to be capable, fairly newcomer friendly and stable. Everything worked well for me, at least on physical hardware. Unity is a bit slow to use in a virtual machine, but the distribution worked smoothly on my desktop computer. Read more