« John Hagel on IT Conversations | Main | Is Your API Too Fat? »
2.9 Million Georgians at Risk for Identity Theft
ZDNet news reports that “A CD containing personal information on Georgia residents has gone missing, according to the Georgia Department of Community The CD was lost by Affiliated Computer Services, a Dallas company handling claims for the health care programs, the statement said. The disc holds information on 2.9 million Georgia residents, said Lisa Marie Shekell, a Department of Community Health representative.”
When I was Utah’s CIO, identity theft on this kind of grand scale didn’t make the news as much as it does now. If I were in that position today, I’d be very scared. It’s not so much that you know about bad data handling practices in the various agencies, but the fact that you know nothing about them. What are the chances it’s all going well with no oversight and no accountability? Zero.
In this case, ACS was a private contractor and is likely to get the blame, but that’s not the root of the problem. The root of the problem is that the state agency trusted them with that data. What reviews were done? Any audits of security and data handling practices? To what standards? Was the data encrypted? Ugh.
Posted by windley on April 11, 2007 2:01 PM
Comment from Eric Norman at April 12, 2007 4:47 PM
I just have to wonder if folks have noticed that all these identity thefts that get reported in the news probably would still be happening even if all these fancy authentication systems that everyone is devoting energy to were in use. E.g. multi-factor, etc.
Encrypted storage and file systems? Maybe, but that's a different story.
Comment from BillyG at April 13, 2007 8:12 PM
"The root of the problem is that the state agency trusted them with that data. What reviews were done? Any audits of security and data handling practices? To what standards? Was the data encrypted?"
Okay, I'll play devil's-advocate here (since it's the first response I thought of anyway): What if they took all the necessary precautions and the answer to your questions is 'Yes'?
Mind you, I have no inside info on this, but it just seems to me that, as humans, mistakes can happen, and it's not always just 'another case of what's been in the news'. Case in point: I put no stock in those ISO-9001 etc. audits.
Your points are certainly taken seriously. I am just over the state line, so I guess we're still good for now, then again SC has a history all its own...
Leave a comment
I encourage you to leave a comment below. Your email address will not be displayed on Technometria, but allows me to communicate with you directly. Your email address won't be displayed, but will be used to compute a MicroID for your comment.