Getting too personal
British Prime Minister Gordon Brown has apologised for his government's loss of sensitive personal data of 25 million citizens and promised that it will not happen again. Now, if ever there was a case not to trust a politician, this is it. Such a pledge, in an era where collecting information about people has become an international sport, is laughable. There is so much personal data about each of us stored insecurely in company files, banks, schools and government departments that it is a matter of when, not if, it falls into the wrong hands.
Tens of millions of people the world over can vouch for this: they have been the victims of criminals who got their hands on such information. The latest identity fraud study by the US-based Javelin Strategy & Research found that, in the year to February, 8.4 million adult Americans had been the victims of fraudsters who had stolen their personal information. In total, they suffered losses of US$49.3 billion.
This was only the tip of the data that went astray. Experts believe crimes occur only in 15 per cent of cases where personal records are lost. The protection group Privacy Rights Clearinghouse has calculated that, since 2005 in the US, security breaches have involved almost 216 million personal records.
Nor is this week's case in Britain involving names, addresses, bank account numbers and social security details the biggest. On May 3 last year, a laptop and computer storage device was stolen from the home of an employee of the US Department of Veteran's Affairs. It contained data that included the names, social security numbers, dates of birth and, in some cases, telephone numbers and addresses of all 26.5 million US military veterans discharged since 1975, and an additional 2.1 million active and reserve service members. Two teenagers were later arrested. The equipment was recovered and authorities claimed that no data had been taken.
There are countless such breaches, albeit on a lesser scale, around the world each day. Computer networks are hacked into, equipment stolen or mislaid and paper records taken.
This does not include people such as myself who daily put ourselves unknowingly at risk by leaving information lying around. Security consultants Adam Laurie and Neal O'Farrell revealed how careless I have been. Mr Laurie, who has led security initiatives in the computer industry for the past two decades from his base near London, made me sweat when telling me about how much information can be gleaned from an aircraft boarding pass stub. With the name, flight details and frequent-flyer code, he was able to tap into the airline's website, buy a ticket and find the passenger's passport number, date of birth and nationality. A mere 15 minutes of publicly accessible online research later, the place where the man lived, worked, the universities he had attended and the amount he paid for his house had been uncovered. Such information could easily be used to gain access to bank accounts and credit cards.
Mr O'Farrell had just as chilling stories. He told, from his California office, how seemingly innocent questions of identity confirmation asked by a crooked bank officer - such as the maiden name of a mother - had led to accounts being emptied.
Both experts concluded that governments, companies and schools were asking for far too much personal information and that they generally were careless about storing it. Technology like biometric passports was being foisted on citizens without forethought to the security risks.
Their advice: refuse to hand over information if it seems unnecessary, destroy documents that are unneeded, closely read bank and credit card statements, and press for tough penalties for officials and fraudsters who breach security regulations.
With this in mind, a few more senior heads should roll in Britain than the revenue and customs chairman Paul Gray (he is the only official to have so far resigned) - to send out the loudest possible message. A minister should also go, and perhaps charges laid against the errant civil servant involved.
Peter Kammerer is the Post's foreign editor
