Wednesday, July 25, 2007

Can Past Lessons Offer Clues to Combating Identity Theft?

In 1994 about 58 percent of the US population was buckling up. By mid 2006 approximately 81% of the US population buckled up. Why the dramatic change? Did everyone suddenly recognize that the seatbelts they had been ignoring for years were suddenly cool? No, the reality came partially with education campaigns and laws enacted by many states in the 80’s that forced or convinced people to buckle up.

Today, the generation who never or barely used seat belts is giving way to a generation who has always used them. Part education, part learned behavior, but regardless the effort has paid off immensely. There are thousands alive today that would not be, if this effort had not been undertaken by numerous agencies, both public and private. Local television news channels tout that drivers of horrific looking accidents survived because they were buckled in. All of this adds to awareness and the effort has made seatbelt use the norm not the exception.

So how well is education and enforcement working? The latest numbers available from the US Department of Transportation shows an increase in drivers, miles driven, and number of registered cars on the road. But the fatalities per number of licensed drivers, per miles driven, and per registered vehicles, have been steadily dropping since 1994. The statistics from the NHTSA from 1986-1999 have clearly demonstrated an absolute link to the reduction in fatalities from seatbelt use.

This proves that the plan of educating and enforcement has worked and continues to work up to this day, but shockingly 19%, or 1 out of 5 still don’t think they need this life saving device. They live in the world of “it will never happen to me”, or “it only happens to other people”. Yet, every 13 minutes there is a vehicle fatality and of those some deaths could be avoided with a seatbelt if the person had only believed or understood.

How this is similar to identity theft is when it comes to our identities many are living in the same world of “it will never happen to me”, or “it only happens to other people”. There are many simple but effective changes people can initiate to stop identity theft from happening but choose not to. There are preventative measures they can put in place to mitigate it, but the majority will sit and wait for something to happen before they react.

As with seat belts, only until people become educated will they take the steps to prevent an event from occurring. Many still refuse to embrace technology to reduce risk, and instead they avoid or ignore it.

Over time, thousands lost lives while sitting on the simplistic technology of an unused seat belt. Will consumers finally step up to the plate and take simple but effective pro-active steps to prevent identity theft, or will they continue to ride around unbuckled and hope an accident never occurs? Every 21 seconds there are 3 new identity theft victims, of which 2 were potentially preventable by the victim.

Abatement of identity theft will start to change significantly once individuals start to take control of their personal behavior and not rely on others or hoping nothing will happen to them. Recognizing the vulnerabilities in personal everyday habits and making changes will reduce your risk significantly.

Many are already recognizing that they need to do something, and the actions of those will undoubtedly start a trend. But for those who are unsure of what to do, and still do nothing, are likely to become tomorrow’s victims.

Hopefully it doesn’t take 15 years for 80% of the population to finally become educated on how to adequately protect their identity.

Monday, July 9, 2007

GAO Reports on Identity Theft, Sort of

Recently the US Government Accountability Office released its findings of a study on the net effect of data breaches, stolen data, and unaccounted for data and how much actual identity theft resulted from such occurrences. They undertook this task to help Congress decide if a federal law should be considered for a national breach notification requirement. Some states already have laws in effect to various degrees requiring notification of data lost so that consumers can take immediate actions to see if they’ve become a victim.

Sounds a bit odd, but breach notification would most likely just give you a heads up a bit sooner if you are a victim. Many times a data breach notification is the first time a victim looks at a bank or credit card statement, balances a checkbook for the first time in ten years, or obtains a credit report.

The GAO was asked to examine three distinct areas

(1) The incidence and circumstances of breaches of sensitive personal information

(2) The extent to which such breaches have resulted in identity theft

(3) The potential benefits, costs, and challenges associated with breach notification requirements.

The GAO used various sources for the research and came up with an earth shattering discovery; data thefts are rampant and occur frequently and are probably underreported due to lack of voluntary or mandatory disclosure.

They also determined they can’t directly link identity theft to many of the data thefts they reviewed because there is not clear and conclusive evidence that directly links those breaches with identity theft. Apparently the identity thieves are not disclosing the abundant sources of their windfall.

There you have it, if it is not conclusive then it must not have occurred, or at least they can’t say it occurred. It does not mean that it didn’t.

They even admitted that the lack of reporting on the part of victims also leads to skewed and invalid data that cannot be used to create a valid statistical picture.

So how do many interpret this : “GAO finds little identity theft results from data breaches”.

Apparently there are a lot of thieves going to a lot of trouble stealing personal data, then changing their minds finding religion and doing nothing with it after all.

But if that is the case, then where did all that personal stolen information come from that results in the billions of dollars in personal losses from the millions of actual victims each year? There was not a place to include them in this report.