Schneier on Security

Roger • January 9, 2006 7:05 PM

“Pre-texting”, huh? Don’t you just love it when people invent nice new jargon words to cover up good old fashioned terms like “impersonation” and “fraud”. Of course, hackish and crackish types have our own jargon term, “social engineering”.

EPIC notes that these companies may use several other methods as well (no doubt, if paid enough they use whatever method works), but all of them consitute unauthorised access to a computer data source. IANAL but this seems to me definitely seriously illegal, as in, go directly to the Federal pen and do not emerge until there’s a “1” in the year. Chris, I wouldn’t just be calling the FTC and FCC, I’d be calling the FBI too.

@Roy:

All telephone traffic within and through the USA … is required by law to be entirely and immediately open to law enforcement for free. …. The system that provides this access cannot be deny access to illicit use

Umm, this has nothing to do with law enforcement taps. The crooks are impersonating the victim and just ask for their itemised bills. Sometimes via a human operator, sometimes via a weakly secured web interface. Completely regardless of law enforcement access, all companies keep these billing records for several years anyway, both to prepare invoices and to respond to disputes. And it is entirely appropriate that the data should be made available to the customer, whether as a basic courtesy and service (in the US model) or because he has a legal right to it (in the non-US model).

The problem here is a combination of minimum wage call-centre operators not trained to understand social engineering, and excessively weak authentication before releasing quite large amounts of quite private information. And it is a problem which is fairly pervasive in our society.

Our European friends tell us that the problem is much less severe in countries with national ID cards, but that solution is no cure all, creates its own issues, and is culturally and political unacceptable in my country and probably the US too. (I would have also said the UK, but they seem to have gone over to the dark side now.)

There is no magic cure all, but Bruce has observed that we can go a long way by putting the responsibility on those with the ability to act on it, i.e. the companies holding the data. Something like, say, a $10,000 fine for the first personal record and a $1,000 fine for each subsequent one which an independant ombudsman is able to obtain, will soon get the data locked up like Fort Knox.