I am concerned when I am at conferences and professional meetings and I hear presenters telling the attendees, from any industry, that there is really nothing that they need to do to address the requirements of the USA PATRIOT Act, and I’ve heard this communicated several times since the law was enacted in 2001.  Here is a good example that yes, indeed, doing nothing can come back to haunt you…and negatively impact your business with penalties and bad press.

It is rare that you see the USA PATRIOT Act, the follow-up for which is the USA PATRIOT Improvement and Reauthorization Act of 2005, being referenced as being part of actions taken by law enforcement for surveillance, or by regulators as part of the basis for fines.  However, I just ran across a story on the government’s FinCEN site that talks about how noncompliance with the USA PATRIOT Act was used in determining a $600,000 penalty against Liberty Bank of New York…I need to check that site more often, don’t I?

In brief, the Financial Crimes Enforcement Network (FinCEN), Federal Deposit Insurance Corporation (FDIC), and New York State Banking Department (NYSBD) assessed a $600,000 penalty against Liberty Bank of New York for violations of federal and state anti-money laundering laws and regulations. Liberty Bank consented to payment of the civil money penalties without admitting or denying the allegations (this is pretty common with regulatory noncompliance situations).

What did Liberty Bank do…or not do?  FinCEN, FDIC, and NYSBD found they:

• Failed to implement an adequate Bank Secrecy Act/anti-money laundering program with internal controls and appropriate measures to detect and report money laundering and other suspicious activity in a timely manner.
• Did not have an anti-money laundering program that complied with information sharing requests from law enforcement under section 314(a) of the USA PATRIOT Act.

I anticipate seeing more, and probably more aggressive/costly, actions taking place with regard to the USA PATRIOT Acts as time goes on…companies need to take notice and be aware; not only for section 314(a), but for all the sections, some of which apply to more businesses than just those considered by the law as a financial institution.

Wonder what section 314(a) is all about?  Here you go:

"SEC. 314. COOPERATIVE EFFORTS TO DETER MONEY LAUNDERING.

(a) COOPERATION AMONG FINANCIAL INSTITUTIONS, REGULATORY AUTHORITIES, AND LAW ENFORCEMENT AUTHORITIES-

(1) REGULATIONS- The Secretary shall, within 120 days after the date of enactment of this Act , adopt regulations to encourage further cooperation among financial institutions, their regulatory authorities, and law enforcement authorities, with the specific purpose of encouraging regulatory authorities and law enforcement authorities to share with financial institutions information regarding individuals, entities, and organizations engaged in or reasonably suspected based on credible evidence of engaging in terrorist acts or money laundering activities.

(2) COOPERATION AND INFORMATION SHARING PROCEDURES- The regulations adopted under paragraph (1) may include or create procedures for cooperation and information sharing focusing on–

(A) matters specifically related to the finances of terrorist groups, the means by which terrorist groups transfer funds around the world and within the United States, including through the use of charitable organizations, nonprofit organizations, and nongovernmental organizations, and the extent to which financial institutions in the United States are unwittingly involved in such finances and the extent to which such institutions are at risk as a result;

(B) the relationship, particularly the financial relationship, between international narcotics traffickers and foreign terrorist organizations, the extent to which their memberships overlap and engage in joint activities, and the extent to which they cooperate with each other in raising and transferring funds for their respective purposes; and

(C) means of facilitating the identification of accounts and transactions involving terrorist groups and facilitating the exchange of information concerning such accounts and transactions between financial institutions and law enforcement organizations.

(3) CONTENTS- The regulations adopted pursuant to paragraph (1) may–

(A) require that each financial institution designate 1 or more persons to receive information concerning, and to monitor accounts of individuals, entities, and organizations identified, pursuant to paragraph (1); and

(B) further establish procedures for the protection of the shared information, consistent with the capacity, size, and nature of the institution to which the particular procedures apply.

(4) RULE OF CONSTRUCTION- The receipt of information by a financial institution pursuant to this section shall not relieve or otherwise modify the obligations of the financial institution with respect to any other person or account.

(5) USE OF INFORMATION- Information received by a financial institution pursuant to this section shall not be used for any purpose other than identifying and reporting on activities that may involve terrorist acts or money laundering activities."

Technorati Tags
information security
IT compliance
corporate governance
Patriot Act
government
awareness and training
privacy

Yesterday I posted a new paper to my site, "Privacy, Compliance and International Data Flows."

In today’s technology and business environment, computers are more mobile and more powerful than ever before. Information is shared more easily, more quickly, and in more ways than previously possible.  One voice-activated command can send a message or document to many different locations throughout the world in milliseconds.  Huge amounts of data can be downloaded onto small mobile computing and storage devices more easily than ever before…and we’ve seen by the ongoing incidents how these mobile devices put data at great risk.

This advanced technology revolution certainly has improved business efficiency and expediency. However, it has also created potential threats to the privacy of personal information and violations of new and emerging data protection laws. In this article I discuss privacy, related laws around the world, compliance and international data flow issues, what organizations need to think about with regard to international data protection, and what they need to do to address the wide range of issues.

Technorati Tags
information security
personal information protection
corporate governance
IT compliance
international data flow
data protection laws
privacy

Much has been written over the past two days about the theft of the laptop from a government worker’s home that contained SSNs, birthdates and names for 26.5 million U.S. veterans. 

What concerns me is a recurring, almost a lackadaisical…and in some cases flippant or dismissive…attitude about these types of incidents.

One in particular on CNET News, "Veterans’ data swiped in theft" captures the essence of some of the recurring themes in these incident reports.  For example:

"The good news for Veterans Affairs is that the crooks may not know what they have.  "It is possible that (the thieves) remain unaware of the information which they posses or of how to make use of it," Veterans Affairs said on the Web site.  Gartner’s Litan agrees. Studies have shown that thefts of computers storing sensitive data have resulted in only a small percentage of identity theft, she says. And she added that information on millions of veterans would not necessarily yield much loot.  "Frankly, veterans don’t have a lot of money," Litan said. "They aren’t typically wealthy people. Criminals aren’t going to be taking out 26 million loans (in the names of the veterans whose information was stolen). That’s a lot of information, and the thieves have time constraints just like everybody else. They want information on the wealthiest individuals.""

Wow, this certainly is good spin from the PR department.

I don’t believe such studies of computers stolen provide any type of conclusive evidence.  SSNs, names and birthdates could potentially be used YEARS after a theft to do bad things.  Just because nothing bad has BEEN DETECTED YET does not mean bad things will never be done with that information. 

Additionally, there are so many ways that this type of information can be misused by the crooks and fraudsters who have this information in hand that it is very possible that the people about whom the information applies will not find about about nefarious activity until years later.  And it doesn’t matter how much money the people involved make…this seems a rather insulting statement to the victims, doesn’t it?  You’re too poor to worry about anyone wanting to do crime with your information?  C’mon now…individuals don’t need to make anything to have their lives made a mess by identity theft!

A great example is a story I read recently in Reader’s Digest about child identity theft.

"Seventeen-year-old Randy Waldron, Jr., was shocked when he applied for his first credit card and was denied. He was even more shocked by the reason: He was delinquent in repaying thousands of dollars in debt.  Waldron’s identity had been stolen by his estranged father, who left when Randy was a toddler. From 1982 to 1999, Randy Waldron, Sr., used his son’s Social Security number to obtain credit from various merchants and lenders, then racked up tens of thousands of dollars in debts. He declared bankruptcy in his son’s name, which resulted in default judgments against the younger Waldron. It has taken Randy Jr., now a 24-year-old flight attendant, years to untangle the mess."

This identity theft…criminal use of another’s SSN and name…occurred for around 18 years without the victim’s knowledge!  And then, the victim, who was not even making money during this criminal activity, was severely impacted for years.  And apparently this type of crime is not uncommon.

The fact is, there are no time constraints on using this type of information.  The fact is, most people are not going to change their names, SSNs or birthdates to make the data invalid.  The fact is, if nothing bad has happened within a few weeks, many, perhaps most, of the organizations that caused the mess…by poor data handling practices, lack of encryption, lack of controls, lack of awareness and training, lack of policies…are not going to step up and do what they should to protect the individuals, which at the least is to enroll them into credit monitoring services.

The fact is, once this much information has been stolen, chances are the culprits are not going to perform the crimes themselves…they possess very valuable information that they can sell…to 1000’s and perhaps millions of other criminals throughout the world…to use at their own leisure.

This particular statement hit a nerve: 

"Criminals aren’t going to be taking out 26 million loans (in the names of the veterans whose information was stolen). That’s a lot of information, and the thieves have time constraints just like everybody else. They want information on the wealthiest individuals.""

What?  Crime with personal information can occur in so many other ways than just taking out loans.  The names, SSNs and birthdates are valuable items…they can be exploited in many ways, and over a course of time by many, many criminals.  It’s just not true that criminals only want information on the wealthiest individuals.  What data supports this?  If you know someone who has been a victim, or at least read the news on a daily basis, you know this.  The most frequently scammed and violated people are those that are not wealthy.  Very rarely do you read about the wealthy that have been victims.  According to various FTC studies and reports this is a widespread problem, and definitely not limited to only the wealthy.  The September 2003 Federal Trade Commission ‚Äì Identity Theft Survey Report indicates that identity theft, and other criiminal use of personal information, impacts people of all income levels.

When an incident occurs, organizations need to be pro-active, not reactive…not waiting until bad things happen to the individuals involved.

Of course, prevention is the best course of action.

• Encrypt mobile data
• Implement strong policies that are enforced
• Provide training…awareness…more training…more awareness…more awareness…more awareness…almost all incidents involve people who did not know any better, but should have.

Technorati Tags
identity theft
information security
personal data protection
corporate governance
laptop theft
awareness and training
IT compliance
privacy

There was a widely reported Reuters story today, "Data on 26.5 million veterans stolen from home" about yet another laptop theft with massive amounts of personal information stored upon it. The theft took place sometime this month.  Data included names, social security numbers and birthdates.

The Department of Veterans Affairs spokesperson indicated the employee took home this large amount of data in violation of "rules and regulations and policies."

Well, it is good they had these policies in place.   Policies cannot prevent people from doing the wrong things, but they are necessary to establish the expectations for appropriate business activities, and the security framework for an information handling and processing environment.

Hopefully there are some strong sanctions policies also in place.  The employee was put on administrative leave during the investigation.

Policies, though, without communicating them to personnel will be ineffective…people cannot be expected to do the right thing if they are not told what the right thing is to do.  Is there a strong information security education program in place at these companies where such incidents are occurring?  I think of the oft-quoted Rumsfeld quote when these incidents occur and I question whether or not there is adequate awareness and training in place, "But there are also unknown unknowns – the ones we don’t know we don’t know."  Your personnel don’t know that they don’t know about information security risks if you have not been communicating with them.  This is a huge risk…ignorance is definitely not bliss for your organization.  Companies need to start beefing up their awareness and training efforts or these types of senseless and avoidable incidents will continue to occur.

Technorati Tags
information security
personal information protection
government
corporate governance
IT compliance
laptop theft
awareness and training
privacy