I've Been Mugged

Are Defaults On Student Loans The Next Financial Bubble to Burst?

There are several posts in this blog about how banks are "mugging" consumers with higher credit card interest rates, lower card limits, increased minimums, and other fees. There is a debate about whether these changes, the high cost of college, and the recession will push many consumers to default on their student loans, or if the problem is poor financial planning and an attempt to avoid personal responsibility. At about the 13-minute mark are hints that the problem may be caused in part by predatory lending and collections policies:

Massachusetts Gets Tough On Data Security (Part One)

Changes are coming to Massachusetts businesses. Bank Systems & Technology reported:

"... come May 1, [companies and banks] will have to be mindful of strict new rules coming from the Commonwealth of Massachusetts around data security. The Massachusetts Data Security Regulations are perhaps like no other in terms of their depth and scope... They go beyond the rules of other states and the federal government that simply require companies to notify their customers of theft of their personal information."

There are several personal data items consumers must protect. Companies and banks keep a wide range of sensitive data about consumers (e.g., customers, employees, contractors, and former employees) which they don't always protect. What makes the Massachusetts law stricter:

"... companies, including banks, that handle the personal data of a Massachusetts resident must show they have in place a comprehensive, written information security program with heightened security procedures around how this information is handled. The rules also extend to entities' service providers and the degree to which they too much show they comply with the Massachusetts rules of handling data on residents. Companies have until May 1 to amend their vendor contracts to reflect this and until Jan. 1, 2010 to certify their vendors comply. Furthermore, companies must comply with these rules even if they do not have a single office in the Bay State or if they are in an already heavily regulated industry, like financial services. As long as customers in businesses' databases reside in Massachusetts, those companies are affected by the rules."

Now that's a law I like. Clear data security protections for consumers. There's more:

"Under the rules, companies have a duty to monitor their security programs on an ongoing basis... The safeguards in the program must be administrative, technical and physical in nature. Entities will be required to identify all records used to store personal information... Businesses must also identify and assess both internal and external risks to the organization. Once these steps are completed, they must then evaluate (and improve, if necessary) the safeguards in place around such areas as employee training and physical security... companies will be obligated to limit the collection and use of personal information. They must identify the purposes for which they collect this kind of information and identify how long the wish to keep it and who can access it."

Since so many company data breaches have involved laptop computers and flash drives, the rules also cover employee training and:

"Companies will be required to encrypt data that is not only stored but also when it is being transmitted over networks or physically moved as when an employees take a laptop home."

Amen. That's pretty good legislation which covers most of the problem areas that cause data breaches. However, I would have liked to have seen specific protections in the legislation about RFID, and jail time for executives at companies that don't comply or experience repeated data breaches.

I encourage Massachusetts residents to write to their elected officials and thank them for these new data security. I encourage residents in other states to ask their elected officials what they are doing about data security so their state does not fall behind Massachusetts.

FTC Fraud Forum

The US. Federal Trade Commission will host a free two-day "Fraud Forum" seminar February 25 and 26, 2009, in Washington, DC. The seminar will examine how the FTC can more effectively protect consumers from scams and fraud. The event is open to the public and will cover the following topics for law enforcement, consumer advocates, business representatives and representatives from higher education:

• "The extent of fraud in the economy and what survey research indicates about fraud victimization rates;"
• "The drivers – economic, sociological, and psychological – that create and sustain fraudulent actors; how new fraudulent actors learn the tools of the trade, and how they target victims;"
• "Whether some segments of the population are at greater risk of being targeted by fraudulent actors; whether victim surveys adequately identify the magnitude and types of fraud launched against all segments of the population; what techniques law enforcement has employed to reach these segments of the population; and"
• "Which best practices in private industries, such as banking, telecommunications, and online commerce, are best suited to identify fraud and prevent their services from being used by fraudulent actors; which systems adequately track potentially fraudulent activity and whether opportunities exist to use new or improved self-regulatory efforts to combat fraud."

The FTC seeks panelists for this event. Interested parties should contact the FTC online to submit their request to be a panelist. The deadline for requests is November 14, 2008.

FTC To Host Radio Frequency ID Workshop

The U.S. Federal Trade Commission (FTC) will host a workshop on September 23, 2008 titled, "Transatlantic RFID Workshop on Consumer Privacy and Data Security." The purpose of the workshop:

"...to explore emerging applications of radio frequency identification technology and their implications for consumer protection policy. The workshop will bring together industry representatives, government officials, and consumer advocates from Europe and the United States to discuss security and privacy concerns associated with RFID technology."

If you are unfamiliar with radio frequency identification (RFID) technology, I suggest that you read these prior posts. As with any new technology, the proper installation and use of RFID -- with adequate data encryption -- is critical, since RFID cards usually contain sensitive personal information of consumers and employees. According to the news release:

"The workshop is being held in conjunction with the September 22, 2008 “Transatlantic Symposium on the Societal Benefits of RFID,” sponsored by the Trans-Atlantic Business Dialogue, the European-American Business Council, and EPCGlobal, with the support of the U.S. Department of Commerce and the European Commission."

The workshop is free and open to the public. If you cannot attend, a live webcast will be available at the FTC web site. The workshop will be held at the FTC Conference Center, 601 New Jersey Avenue, N.W.,Washington, DC 20001.

Maybe the three enterprising M.I.T. students will attend and contribute to the discussion.

FTC and California Office Of Privacy Protection To Co-Host Workshops on Data Security

On August 13, 2008, the U.S. Federal Trade Commission (FTC) and the California Office of Privacy Protection will co-host a half-day public workshop in Los Angeles about how businesses can secure personal information and protect the privacy of consumers and employees:

"The workshop, "Protecting Personal Information: Best Practices for Business," is presented in partnership with the International Association of Privacy Professionals and the Los Angeles Area Chamber of Commerce. It features business people, attorneys, government officials, privacy officers, and other experts who will provide practical guidance for businesses of all sizes on data security, privacy, best practices for developing an appropriate data security program, and responding to data breaches and other privacy and security problems."

Effective data security is critical to consumers' trust in corporate brands. Notable panelists and speakers scheduled for the workshop:

• Barbara Lawler, Chief Privacy Officer, Intuit
• Jill Phillips, Chief Privacy Officer, Chevron
• Shai Samet, President and Founder, Samet Privacy LLC
• Andrew Serwin, Partner, Foley & Lardner
• Jonathan Avila, Vice President, Counsel, Chief Privacy Officer, The Walt Disney Company
• Lt. Robert (Rocky) Costa, Los Angeles County Sheriff's Department and Southern California High Tech Crimes Task Force
• Richard Purcell, Chief Executive Officer, Corporate Privacy Group

This workshop is timely and especially relevant, since a recent study found that corporate data breaches occur largely due to incompetence. If the FTC continues to do its job, it should co-host workshops in more states. Read about the wide range of sensitive consumer data companies archive.

I am unable to attend this workshop. If any I've Been Mugged readers attend the workshop, please post comments below.

Blogtoberfest (Meeting Boston Bloggers, Part Two)

During the day I'm super busy at my day job building web sites. However, I'm glad that I made time yesterday evening to attend the 2007 Boston Blogtoberfest event at the Pour House bar on Boylston Street.

This event was an opportunity to meet other Boston-based bloggers. I'd like to publicly thank Jenny Frazier for organizing the event. There must have been 40 or 50 bloggers in the downstairs room at the Pour House.

As I wrote in a prior post, I'm fairly new to blogging and this was my second blogger social (this week). It felt very empowering to meet several local bloggers, who write about a wide range of subjects:

• Wade Roush at Xconomy,
• Tammy Schuetz at Boston Food & Wine,
• Michael Krigsman at IT Project Failures,
• Victoria Welch and Jon Petit at the Bostonist,
• Ryan Barrett at Cheap Thrills,
• Jonathan Feeley at Digital Interactif,
• Boston Transplant,
• Christopher Ott at the ACLU, and
• Eileen's very funny Divine Comedy of Errors.

The event was an added treat since I won one of the raffle prizes... a framed photograph of beautiful and historic Fenway Park.

Boston bloggers who weren't there, and I hope they attend the next event: Lori Magno's Moda di Magno, Kate Beaton's The Dish, Diane Danielson's Downtown Women's Club, and Mick O'Brien's Attention Shoppers.