Data voyeurism is common
Posted: Friday, March 21 at 02:13 pm CT by Bob Sullivan
If you think the State Department passport privacy debacle is an oddity, it isn’t. Data voyeurism is actually a sign of the times. Low-level employees at government agencies and private companies browse personal information for sport all the time. Outside of the occasional public flogging, little has been done to stop this unnerving practice.
It now appears no candidate will win extra sympathy points for the passport privacy invasion at the State Department, because all of them have been victims. It's too early to know if any of the culprits saw data that could have hurt any of the candidates politically, but that matters little. In fact, let's give all those involved the benefit of the doubt, and say this was merely a database joy ride. The real question is this:
If the State Department can't protect presidential candidates' personal information, how can anyone protect ours?
Data voyeurism stories can be found across the news spectrum. Hospital workers caught browsing celebrities' medical records; cops caught checking out cute women by running their license plate numbers. Computer security expert Avivah Litan, a consultant at Gartner, said most firms don't go to great lengths to keep employees away from such data.
"When I saw this article the first thing that crossed my mind was that this kind of thing happens all the time," she said. "It's not uncommon at all kinds of organizations. It brings up the question of how private our data is. It's not."
Didn't need the data
The State Department incident could have been something much more serious than a computerized peep show. These data thieves could have been looking for information, like Social Security numbers, to commit identity theft. Identity thieves often begin their crimes by obtaining data stolen by employees. One study conducted several years ago by Michigan State University researcher Judy Collins found that in most cases of ID theft traced to an employee, that the employee did not need access to the victim's data to do his or her job.
In other words, there were lax or no internal controls.
Privacy consultant Larry Ponemon recently completed a survey of security professionals about the lack of internal data controls, and his results were alarming: 78 percent said employees at their company have too much access to data, and 69 percent said access rules were poorly enforced. The longer an employee stays at a firm and changes jobs, and the more often that firm changes systems, the more difficult it is manage database access rules.
“Even at the most sophisticated companies, identity management is often an Achilles' heel,” he said.
Litan says things don't have to work this way. Employees' access to databases with personal information should be strictly limited. Instead, many workers have blanket permission to look at everything.
"It's called identity access management, or access controls,” she said. “No one has to see that information unless they have privileged access."
Either the State Department had no such access rules to data belonging to Sens. Barack Obama, Hillary Clinton and John McCain – which would be crazy, since they are surrounded every day by men in black suits sporting concealed weapons and wireless ear pieces -- or someone with high-access privileges was involved in the data snooping. Both prospects are disturbing. And both could easily happen to you.
Now, which candidate will be the first to support a new, comprehensive privacy law?
Where candidates stand on consumer issues
EMAIL THIS
TRACKBACKS
Trackbacks are links to weblogs that reference this post. Like comments, trackbacks do no appear until approved by us. The trackback URL for this post is: http://www.typepad.com/t/trackback/454638/27327026
advertisement
BUY BOB SULLIVAN'S NEW BOOK
Bob Sullivan's new book unmasks hundreds of hidden fees and offers step-by-step instructions on how to fight back. Order it here.
Syndicate this site
RSS is an easy way to get the news you want as it is updated even if you are not on MSNBC.com. More information about MSNBC.com's RSS feeds.
More consumer news
Consumer Man, aka Herb Weisbaum, exposes scams and answers questions




"Now, which candidate will be the first to support a new, comprehensive privacy law?"
Ron Paul.
The other three are two certified Communists and a stealth Communist, and if they supported a new, comprehensive privacy law, the US-Stasi they plan to create would have some trouble keeping files on all of us.
Ann, KC MO (Sent Mar 21, 2008 3:06:05 PM)
I agree. Employees everywhere have access to too much data. Procedures need to be in place to ensure that employees can only access what is needed to do their job. The less everyone including my co-workers know about me, the better.
(Sent Mar 21, 2008 3:07:47 PM)
Payroll records at many companies are often reviewed by employees with no legitimate reason for viewing the data. This information is often shared with co-workers and friends. Not only is privacy violated, but data can easily be used for theft, fraud, or indentity crimes. Many times it is the IT department responsible for data security that violates privacy!
(Sent Mar 21, 2008 3:39:16 PM)
CISSP certification ftw.
(Sent Mar 21, 2008 3:48:35 PM)
The bush presidency has failed to protect anyone's privacy. Take the illegal wiretapping - it isn't evesdropping - it's spying on American citizens. I can understand Fox News buying that line but even MSNBC calls it evesdropping. As for the "apology" to Obama for checking out his passport records - it smacks of "well we didn't shoot just YOUR dog, we shot your neighbor's dog and our own dog too so it's nothing personal or political".
(Sent Mar 21, 2008 4:11:54 PM)
The media goes on a feeding frenzy when Obama's, Clinton's and McCain's files are breached. We aren't supposed to have an aristocracy in this country where was the same level of media outrage when "ordinary" citizen's rights to privacy and security from voyeurism were breached. Not just passport files but phone records and who knows what with the 30,000 "security letters", all without warants.
The candidates want an investigation, it didn't seem to hurt as much when it was ordinary folks that were being violated.
Herman Vis, Santa Rosa, CA (Sent Mar 21, 2008 4:17:43 PM)
Notice how the highest levels of government jump when it is one of their own that has been victimized, but if it is the average citizen good luck getting anyone to pay attention.
Thanks Bob, for speaking truth to power - as you always do!
Rob Douglas - InsideIDTheft.info (Sent Mar 21, 2008 4:46:27 PM)
I've given up the notion of privacy long ago. It's not just employees snooping. Anyone can find out anything about anyone - nieghbors, ex-spouses etc have been caught snooping. It's often the price we pay for technology advances. I have nothing to hide ( :
Pamela, Atlanta, Georgia (Sent Mar 21, 2008 4:57:06 PM)
Outrageous ... these employees knew it was wrong and deserve to be punished for the laws they broke. Do we really need a Congressional investigation for this
(Sent Mar 21, 2008 5:24:43 PM)
The simple fact of the matter is that a person is always and must be involved in determining the identity of an applicant, especially in granting federal documentation. Computers aren't smart enough to recognize whether you are who you say you are. We can only put assurances on whether we grant rights to these functions to people that can be trusted. We will always be succeptable to this type of abuse. Assume the risk.
henry (Sent Mar 21, 2008 5:34:03 PM)
Takes you back to the cold war days ... except we are the guinea pigs and the government is the KGB lol. Its not the "price of the times" its the time to pay for our ignorance.
(Sent Mar 24, 2008 10:28:35 AM)
One BIG problem is that privacy policies conflict with the actual practices within the organization. Example: I used to occasionally temp at a large teaching hospital. Access to patients' medical records was limited, with a secretary's access usually limited to basic contact information and lab reports. But doctors would frequently request that the patient's most recent reports and labs be printed out before clinic appointments. The quickest and simplest way to do this was for the patient to log on as the doctor. Doctors who wanted to do this would entrust their logons to their secretaries, but it was pretty easy to find out any doctor's logon if you knew how the system worked. I imagine that in any large organization, especially one where people have more important things than data security to worry about, there will be a mismatch between security needs and the demands of the job.
I am more concerned about the prevalence of "contract employees" in our government. I for one would feel safer if I knew my data were being viewed by career civil servants rather than "temps" primarily responsible to some private contractor. To me "contract employees" translates to "high turnover," which also increases security risk. Time was when there was supposed to be a bright line between the government and the private sector. It's time to re-draw that line and get rid of the contractors.
Grumpyoldlady, Ann Arbor, MI (Sent Mar 24, 2008 12:05:40 PM)
The government has shown time after time it cannot protect personal information. Yet Congress keeps passing laws that allow the government to collect more and more personal information.
Then we have Bush and Cheney on top of all those laws already passed demanding more. Sure the media reports some leaks, but then the story just fades out. What are the people supposed to do? We don't get the full story of the leaks in most cases, the government denies there is a problem and the media drops the subject after a few reports.
JMM, Pgh., PA (Sent Mar 24, 2008 1:05:05 PM)
You know the military has a wonderful system besides the usual security clearance. It is called Need To Know. So if you have top secret clearance but do not have a need to know on say a confidential document. Then you can't read the thing. If you do you are looking at severe punishments. So why don't companies work on that premise? I have blanket access to files where I work, but that is a side effect of needing master passwords to fix certain problems. But I do not abuse the trust put in me with that responsibility. So maybe we need to screen the people we put into these positions before we find new means of locking things. Remember locks don't stop dedicated criminals. They keep honest people honest.
Dave, Lumberton New Jersey (Sent Mar 24, 2008 1:49:20 PM)
It should be noted that it was VP Al Gore who down-sized Govt. during the Clinton Admin which has resulted in agencies hiring large numbers of "contractors" instead of maintaining an adequate core of professionals to accomplish even more work today. It now costs twice as much to keep the contractor vice the career employee. We have already seen results of this "privatization" in Iraq.
(Sent Mar 24, 2008 2:10:00 PM)
For those of you like "Pamela" from Atlanta Georgia in previous message that say "You have nothing to hide" your being naive, Have you not heard of Identity Theft? Have you not been watching or reading the news? You wouldn't want to post you name,address and social security# on this message board would you? Because thats all it takes for some one to financially ruin your life! So don't think you have nothing to hide or you just might end up not having nothing at all.
Steve, Springfield,Oregon (Sent Mar 25, 2008 2:00:10 AM)
Ron Paul seems to be THE only candidate who is interested in the security of the US citizen. I marvel that so few people want him to be the LEADER of the USA. Do citizens not want a sovereign nation anymore?????
S. Ivy (Sent Mar 25, 2008 6:25:39 AM)
excuse me, let's get this straight. security employees at this level know that they are not supposed to access these files without authorization, and they know how to access information without inadvertantly opening another file. this is ludicrous in the extreme for Mr. Sullivan to put forward such an unknowlegeable premise. To get Sen. Obama's passport information - his own passport file has to be opened. You don't get information about Sen. Obama by opening Sen. Clinton's passport file... or my file... or anyone else's file. And, these employees were not low level if they had access to these high profile files.
The bottom line is that someone wanted this information on Sen. Obama's passport file and these employees were directed to get it. The question begs: "Who would benefit from such information?" Those who would use the information to launch their own covert investigation and use the information gathered to smear Sen. Obama. If a full investigation is done, it will lead us to those who wanted (and got) that information. The opening of Sen. Clinton's and Sen. McCain's passport files is an amateurish attempt at diverting attention. For anyone to honestly believe that it was just "curiosity" on the employees' part, or lack of knowledge and/or training is to be blind to the dirty political tricks that are now common in our day.
tomulcak, sanmarcos, tx (Sent Mar 25, 2008 9:39:20 AM)
The Patriot Act, no-court wiretaps, private citizens taken overseas for interrogation and computerized invasion of everyone's telephone calls are all much more worrisome to me.
If employees at the federal level can see my text messages, e-mail, web browsing and listen to and even record my phone calls,what expectation of privacy is there left?
Look, if a cop and saw a cute girl, he might run her plate to figure out where he might meet her (local restaurant maybe?) but a cop is not going to turn into a stalker. Access to data will not turn good people into bad ones.
The chilling danger is to mass-protest situations. Imagine if China knew the address and phone number of all the people in China who wanted free elections and a democratic government... wouldn't those people be rounded up and either reducated (tortured) or killed?
Governments, and government agencies will always be bent to the will of the politcally powerful (Nixon did intend to bug on his political opponents when he authorized the Watergate burgalry).
Who said that "Power corrupts" ??? They were understating the case. People are curious, dare I say we are nosey snoops? But reading some private detail is not the danger, its giving governments complete access to know who every citizen is, and who supports which causes.
Suppose the name of every dissident had been available to Stalin? Or if the location of every Gypsy, Chech and Jew had been known to Hitler's death machine? Suppose China had the name and e-mail address of the people who are proitesting the continued invasion of Tibet?
Support your civil liberties, or risk losing them!
Thank you for reading this.
John Rosengarten (Sent Mar 25, 2008 11:41:02 AM)
I worked for the IRS for more than 37 years. They were called to task by former Senator John Glenn for what they called "browsing". At first, employees were given less sever penalties. Every year, each employee who worked on any of the dozens of different systems within the organization, would have to go over the data security rules with their managers and sign a document that they understood them. To this date, employees, although very few, access records for which they do not have authority. It practically can not be totally stopped. If businesses were to implement the complex monitoring system and allocate as many staff years as is necessary to monitor the system, either prices would go up, productivity would go down, businesses would go belly-up or all three.
No doubt, congress will get nasty, fingers will be pointed, and new elaborate costly monitoring systems will be put in place, but in the end, it will continue to happen, although at a much lower rate
Dan of All Seasons, Newton, Ma (Sent Mar 25, 2008 12:08:20 PM)
Why aren't the pundits talking about Hillary relationship with Rev. J Wright, during the time she and Bill were having personal problems that erupted all over the news. Rev. Wright was consulted by the Clintons, and he has been in there company on many occasions; refer to New York Times. This is the same old political maneuving we have been explosed to over the years. DOUBLE STANDARD Now Hillary wants to change the rules over Flo and Mich, and now there discussion of pledged delegates. WHAT IS DIFFERENT BETWEEN HER AND THE BUSH ADMINISTRATION? If things are not going her way, I will just change the rules. Please address my concerns on MSNB.COM
Tracy Fields * Berkeley, CA (Sent Mar 25, 2008 9:36:13 PM)
And now we have passports being processed and printed by firms in other countries! When does it end??
(Sent Mar 29, 2008 1:18:22 PM)
I worked for a police department in the late 1970's-1980's and it was not unusual to run the records of movie stars, friends, etc. This was just curiosity. No one stalked anybody because of it.
Just curious, Los Angeles, California (Sent Apr 1, 2008 11:13:25 AM)
The digital world is very open, very accessible, and very public. Even the best security solutions can be worked around.
Now, does that mean giving the federal government authority to spy on U.S. Citizens without warrant or reason is OK? Not a chance. Suspending civil rights for security smacks of dictatorship, and opens a back door to regulating what people say out of fear.
Hindering free speech because of fear? I really don't like the way that sounds.
(Sent Apr 1, 2008 1:14:40 PM)
SEND A COMMENT
PLEASE READ: All comments must be approved before appearing in the thread; time and space constraints prevent all comments from appearing. We will only approve comments that are directly related to the blog, use appropriate language and are not attacking the comments of others. Firms mentioned in our comment area are welcome to add their own comments.