Risks of third-party data
R ecent reports of personal information theft are coming in torrents. Criminals are known to have downloaded the personal credit information of over 145,000 individuals from ChoicePoint's network. Hackers took over one of the LexisNexis databases, gaining access to personal files of 32,000 people. Bank of America Corp. lost computer data tapes that contained personal information on 1.2 million federal employees, including members of the U.S. Senate. A hacker downloaded the names, Social Security numbers, voice mail, SMS messages, and digital photos of 400 T-Mobile customers, and probably had access to all of T-Mobile's 16.3 million U.S. customers. In a separate incident, Paris Hilton's phone book and SMS messages were hacked and distributed on the Internet. The risks of third-party data—personal data being held by others—are twofold: the privacy risk and impersonation leading to fraud (popularly called identity theft). Identity theft is the fastest-growing crime in the U.S. A criminal collects enough personal data on someone to impersonate him to banks, credit card companies, and other financial institutions, then racks up debt in the person's name, collects the cash, and disappears. The victim often must spend years clearing his name. Total losses in 2003: $53 billion. People have been told to be careful: not to give out personal financial information, to shred their trash, to be cautious when doing business online. But criminal tactics have evolved, and many of these precautions are useless. Why steal identities one at a time, when they can be stolen by the tens of thousands? The problem is that security of much of our data is no longer under our control. This is new. A dozen years ago, if someone wanted to look through your mail, he had to break into your house. Now he can just break into your ISP. Ten years ago, your voice mail was on an answering machine in your house; now it's on a computer owned by a telephone company. Your financial accounts are on Web sites protected only by passwords; your credit history is stored—and sold—by companies you don't even know exist. Lists of books you buy, and the books you browse, are stored in the computers of online booksellers. Your affinity card allows your supermarket to know what foods you like. Others now control data that was once under your direct control. We have no choice but to trust these companies with our security and privacy, even though …