Schneier on Security

Davi Ottenheimer • July 6, 2005 10:50 AM

@Anonymous

Very true as well. The Florida election never recovered from ChoicePoint’s erroneous lists that showed tens of thousands of “possible felons”. But accuracy was not the point, as the Guardian article (cited above) recounts:

“James Lee, a vice-president of ChoicePoint, told Newsnight that Florida, governed by Mr Bush’s brother Jeb, had made it clear that it ‘wanted there to be more names [on the list] than were actually verified as being a convicted felon’. Mr Bush’s eventual majority in Florida was 537.”

With regard to the cost of purchasing identity data in the US, the Guardian article also explains that “In Mexico, the president of the federal electoral institute, Jose Woldenberg, revealed that his investigators had talked to the Mexican company that said it paid a ‘third person’ 400,000 pesos (£24,500) for a hard disk full of personal data drawn largely from the electoral roll. It sold this to ChoicePoint for just $250,000, indicating the huge profitability of ChoicePoint’s contracts – last year’s $11m payment was part of a five-year contract worth $67m.”

So there you have it in black and white:

US$50K for a disk in Mexico that is sold for US$250K to ChoicePoint, which is then sold to the government for millions.

Davi Ottenheimer • July 6, 2005 4:43 PM

@Alex
Thanks for the link. To be fair, it seems that Equifax CEO Thomas Chapman is arguing that it is un-American to regulate a company, even when it means requiring data security (confidentiality and integrity) requirements be placed above profitability.

http://www.wired.com/news/privacy/0,1848,68030,00.html?tw=wn_tophead_1

But based on the Wired article he actually appears to admit that selling potentially-false or misleading information may very well be the foundation of Equifax’s $1.27 billion in revenue last year. Even more surprising is that Wired suggests that he alludes to breaches that have not been disclosed. In sum, the article seems to try and confirm the ChoicePoint dilemma, which states that if you suddenly require the data warehouses to operate securely (and make them liable for all the lives they have ruined, or will ruin), they might have a problem sustaining their recent boon years of profitability.

I find it hard to believe that a CEO like Chapman would come out with such a vituperative stance on this topic, especially given all the obvious bad press that will result. Consider the latest warning shot fired by the Economist:

http://www.economist.com/printedition/displayStory.cfm?story_id=4112390

“Surely it should be obvious to the dimmest executive that trust, that most valuable of economic assets, is easily destroyed and hugely expensive to restore—and that few things are more likely to destroy trust than a company letting sensitive personal data get into the wrong hands.”

Perhaps Chapman did not get the memo…?

Davi Ottenheimer • July 7, 2005 1:12 AM

@SicV

Did you mean nobody expects privacy when in Russia, or that nobody in Russia cares about privacy or other human rights?

Sergei Smirnov recently noted:

http://www.edri.org/edrigram/number3.10/Smirnov

“‘The biggest problem is indifference of Russian citizens to their rights, ‘legal nihilism’. If we talk about digital rights, especially privacy, many people (including some of our colleagues) reply ‘I don’t care about someone reading my personal data since I’ve nothing to hide’ or ‘You’ve no chance to protect your rights in this country’.”

More information can be found here:
http://www.hro.org/docs/reps/privacy/2002/eng/index.htm

Note the section on “liability for invasion of privacy”:
http://www.hro.org/docs/reps/privacy/2002/eng/liability.htm