McPaper:
You won’t guess who’s the bad guy of ID theft
“Identity theft” has become a well-known term in the new century, the subject of news reports and talk shows. Its specter worries consumers as they use their credit cards, write checks, show a driver’s license to a store clerk or order merchandise online.
The conventional wisdom is that just about everybody is vulnerable to identity theft. Furthermore, after it occurs the remedies are both painful and unsatisfactory. The book’s title itself -Zero Day Threat - is scary when translated into common parlance. A zero day threat, as defined by the authors, is “a hazard so new that no viable protection against it yet exists.”
Despite the currency of the subject, nobody has written a book about identity theft quite the way Byron Acohido and Jon Swartz have done. Both technology reporters for USA TODAY, Acohido and Swartz have ferreted out scandal within the identity-theft realm that is bound to lead to reader outrage. Whether the revelations will lead to meaningful reform by Congress and federal regulatory agencies remains to be seen.
Surprisingly, the real villains in Zero Day Threat are not the identity thieves themselves, despite their unsavory lives of crime. Rather, the villains are supposed pillars of communities: bankers, credit-bureau managers and computer makers who enable the burglars, and who could ameliorate the identify-theft crisis but, instead, look away in the name of larger corporate profit.
Acohido and Swartz did not expect to write a book about villainous bankers, credit-bureau managers and computer makers when they began research five years ago. They began by writing reports for this newspaper on PC viruses and spam, which at first seemed like mutually exclusive topics. The more they reported on their disparate stories, the more Acohido and Swartz realized that spammers and virus writers were more than amateur disrupters in cyberspace. In fact, many of them had become cybercrooks, capitalizing on the vulnerabilities of the Internet.
“We found that there were much more complex contagions eroding the security and privacy of sensitive data” than mere spammers and virus writers, Acohido and Swartz comment, “and those corrupters had more to do with business practices and marketing strategies of the financial services and technology industries.”
The authors promise “astounding revelations,” and they deliver. In keeping with the complexity of identity theft, Acohido and Swartz organize the book in a complex, even daring, manner. Each chapter has three recurring sections - Exploiters, Enablers and Expediters.
The Exploiters consist of the lawbreakers, some of them addicts needing money for narcotics, some of them stone-cold-sober career criminals operating identity-theft syndicates across national borders. The Enablers consist of the banks, credit bureaus, credit card companies and data brokers seemingly blind, deaf and dumb to the need for privacy protection. The Expediters consist of the technologists who write computer programs with good intentions (at places like Microsoft), and their evil twins who write programs as recreation to disrupt networks.
I give the theory of financial industry culpability a lot of credibility — a cottage industry around identity theft protection has sprung up. My bank sends me applications for ID theft insurance in the mail about once a week, advertises it prominently in its branch locations, its tellers hawk it to me about every other time I have to use a teller, and its telephone banking system does the same about once every three times. Since most banks aren’t responsbile for the amounts stolen from their customers’ accounts, and don’t have to refund it, the banks lose nothing with ID theft, but the fear of ID theft and the insurance they peddle means that they have something to gain, and by deduction something to lose if they do what these authors think they’re deliberately not doing.
And that’s not counting the services available from firms other than banks — if you listen to talk radio for one solid day, you’ll hear probably a dozen ads for “identity locks,” “credit bureau monitoring,” and so on. That industry dries up with a real ID theft solution, and has a built-in motive not to see one come to fruition.
A significant percentage of identity theft would be possible if not for Microsmeg’s swiss cheese operating systems, fundamentally designed in the pre-internet days (even NT-based OSes), but expected to power the desktop clients for the global medium. Spam e-mail is the incubator of many ID scams, and spam is only possible these days because of desktop computers hijacked by ActiveX controls and other applications that take the secret liberty of turning your computer into a secret e-mail server. I wouldn’t be surprised if Microsmeg was benefitting from the fear-of-ID-theft-industrial complex.
Yes, one should say that end users shouldn’t be suckers, but P.T. Barnum’s axiom that a sucker is born every minute doesn’t stop being true just because we’re in the Internet Age. We have a Federal Trade Commission because suckers will always be with us.
Remember, one to the taboo elements of identity theft is that many of the scam ring-leaders are in or around Nigeria, a.k.a. Scam.
