Report - Guardian

The LSE Identity Project Report: June 2005 101suspicious activity takes place in their name. The FTC also calls for improvedmechanisms to deal with investigations, which is the leading complaint from victims,and for better data management practices, reducing the amount of personal informationavailable to others. The FTC found that victims preferred stronger authenticationmeasures for credit cards, as well as more thorough identification measures foremployees during credit transactions. 271A recent project at Johns Hopkins University illustrated the ease of identity theft in theUS. Post-graduates involved in the study were encouraged to use legal, public sourcesof information, in order to try to steal identities for less than $50. The project concludedthat this could trivially be achieved, and that there was a need for better regulation ofthe use of personal information. 272In the US data-mining institutions are not tightly regulated. In the period of February toMay of 2005 there have been over twenty cases of security breaches at largeorganisations in the US, resulting in the theft or loss of over 5.5 million records. 273 Thecases vary in form and motive:- employees selling information, e.g. Bank of America employees were caughtafter selling 676,000 customer records 274 ;- malicious hacking of databases, e.g. LexisNexis found that 310,000 files mayhave been accessed 275 ;- theft of computers, e.g. the University of California-Berkeley discovered thetheft of a university laptop computer containing 98,000 applicant records 276 ;- loss, e.g. Bank of America lost backup tapes containing the personal informationof 1.2 million federal employees. 277One of the most recent breaches of security involved the loss of 3.9 million records byCitiFinancial, the consumer finance subsidiary of Citigroup. 278 There are continued callsfor further regulations in the US on the use of personal information by governmentagencies and companies in order to rectify this situation.ID Theft in the UKInformation collection and processing is regulated in the United Kingdom under theData Protection Act 1998. This law does not limit the amount of personal informationthat is collected, so long as the amount is proportionate to the purpose. As in the US,there are numerous credit reporting agencies (e.g. Equifax and Experian), the publicregisters (e.g. the electoral roll), and various data mining companies (e.g. Reed ElsevierGroup plc).271 FTC report, page 63.272 ‘Personal data for the taking’, Tom Zeller Jr., The New York Times, May 18, 2005.273 ‘A Chronology of Data Breaches Reported Since the ChoicePoint Incident’, Privacy Rights Clearing House, May4, 2005.274 ‘Bank security break may be the biggest yet’, CNN Money, May 23, 2005.275 ‘Searches conducted in hacking probe’, CNN, May 19, 2005.276 ‘Thief steals UC-Berkeley laptop’, CNN, March 29, 2005.277 ‘Bank Loses Tapes of Records of 1.2 Million With Visa Cards’, Saul Hansell, The New York Times, February 26,2005.278 ‘Personal Data for 3.9 million Lost in Transit’, Tom Zeller Jr., The New York Times, June 7, 2005.