I've Been Mugged

Development Starts On The Age Of Conversation: Third Edition Book

I am pleased to announce that work has started on the third edition of the Age Of Conversation book! You may remember that I authored a chapter in the second edition: The Age Of Conversation: Why Don't They Get It.

Well, the editors of the third edition are accepting new authors. Each author is responsible for writing a one page chapter up to 400 words. Chapters must be submitted during November 2009. Authors can select one of ten (10) themes to write about. The third edition will feature up to 300 authors. All proceeds from book sales will go to a charity to be selected by the authors.

If you are interested, I suggest that you read more at either of the editors' blogs: Drew McLellan or Gavin Heaton. Both blogs have a link so you can sign up and choose your theme.

Which theme did I pick? To find out, you'll have to read the third edition of the book when it is available in 2010.

Celebrating Two Years Online!

Two years ago today, I started the I've Been Mugged blog. Since then, I've learned a lot about identity theft, fraud, privacy, and data breaches. This blog has been a good tool to organize my thoughts, learnings, and the online resources I've found. During the past year, a new Twitter feed and Facebook page have helped I've Been Mugged reach new readers.

Some thank-you messages are definitely called for. First, I'd like to thank I've Been Mugged readers. Weekdays, the I've Been Mugged blog gets about 350 - 400 hits daily. I am grateful for our readership and for the comments you have submitted. W have explored together many interesting topics, and I look forward to more exploration.

Second, I'd like to thank the bloggers and the consumer advocates I've met online. Without their suggestions and encouragement, The quality of I've Been Mugged posts wouldn't be as high as it has been. Some bloggers I'd like to thank by name: John Taylor, Lori Magno, Diane Danielson, Michael Krigsman, Chris Ott, Drew McLelland, Ryan Barrett, Ronni Bennett (who leads by example far more than she realizes), and Jonathan Feeley.

Third, I'd like to thank my guest author, Bill Seebeck, for his insightful and controversial posts.

Fourth, I'd like to thank the Privacy Crusaders. If you know who they are, then you know the good they've done.

Fifth, I'd like to thank IBM for losing my sensitive personal data during their February 2007 data breach. That incident caused me to start blogging. The more I learned about data breaches and the way companies assist (or don't) their data-breach victims, the more I realized that I had to do something. Rather than be angry, blogging seemed like a healthy and appropriate response.

If you haven't noticed yet, I named this blog in honor of IBM's data breach = I've Been Mugged.

And, I especially want to thank my wife, Alison. Without her support and flexibility, I couldn't write I've Been Mugged.

What's next for the coming year? We'll continue to write about identity theft topics, data breaches, and areas where corporate responsibility is lagging. Of course, we'll follow hot topics such as medical identity theft and fraud, behavioral advertising, and identity-theft legislation.

We'll continue to report on emerging issues that affect consumers; like our February 2009 blog posts about higher credit card interest rates by banks in March and April that affected consumers. And, we'll sprinkle this blog with plenty of ID-theft humor, since it's never all doom and gloom.

When it comes to identity theft, data breaches and corporate responsibility, there seems to be plenty to write about.

Get 'Mugged' On Twitter

I am pleased to announce that interested users can follow my updates on Twitter.  My "tweets" includes both updates from the I've Been Mugged blog, and related issues about data breaches, privacy, and consumer rights.

Get 'Mugged' On Facebook

I am pleased to announce that starting today, Facebook users can easily follow updates from the I've Been Mugged blog.

Simply, visit the I've Been Mugged Fan page on Facebook.com and select the "Become a Fan" link.

It's that easy!

Boston.com Features I've Been Mugged Blog

I am pleased to announce that the Boston.com site (published by the Boston Globe newspaper) features my I've Been Mugged blog on the Identity Theft page within its Personal Financial site section.

Image Of the Week

I'd like to thank I've Been Mugged readers for their support. Readership continues to increase. During the last three weeks, readership has increased dramatically:

Most Popular Posts At I've Been Mugged

Which posts do I've Been Mugged readers read the most? Here they are:

1. Suze Orman Identity Theft Kit Debuts
2. Bank Of New York Mellon's Offer To Its Data Breach and ID-Theft Victims
3. Kroll's Offering From IBM Deserves Scrutiny
4. Experian Triple Alert Credit Monitoring Service (product review)
5. Debix, LifeLock, and TrustedID
6. 2008 Consumer Fraud and Identity Theft Complaint Data (FTC)
7. Bank of New York Mellon Data Breach Affects At Least 4.5 Million Consumers
8. Security Freeze: Peace Of Mind And Protection For Your Credit Reports
9. Sidejacking: What It is and How to Protect Yourself
10. Consumer Reports On LifeLock

Celebrating One Year Online!!

A year ago today, I started the I've Been Mugged blog. It has been a fun-filled year and I've learned a lot about identity theft. This blog has been a good tool to organize my thoughts, learnings, and the online resources I've found.

Some thank-you messages are definitely called forr. First, I'd like to thank IBM for losing my sensitive personal data during their February 2007 data breach. That incident caused me to start blogging. The more I learned about data breaches and the way companies assist (or don't) their data-breach victims, the more I realized that I had to do something. Rather than be angry, blogging seemed like a healthy and appropriate response.

Second, I'd also like to thank the bloggers that encouraged me and provided blogging advice. Without their support, the quality of my posts would have suffered. And the I've Been Mugged readership wouldn't be as large as it is.

So, I'd like to send a huge thanks to Lori Magno, Diane Danielson, Michael Krigsman, Chris Ott, Ryan Barrett, Kate Beaton, Ronnie Bennett, and Jonathan Feeley. All have supported me in ways large and small; direct and indirect. These bloggers work very hard and write some awesome, interesting blogs. I hope that you'll read their blogs frequently!

I'd also like to thank my wife, Alison. Without her support and flexibility, I couldn't write I've Been Mugged.

What are my plans for the coming year? Part of this site's content is dedicated to corporate data breaches and identity-theft legislation (at either the Federal or local levels). Unfortunately, the past is a good predictor of future corporate data breaches.

Another portion of this blog is dedicated to IBM, since their year of free credit monitoring service ends soon. It'll be interesting to see what communications arrive from IBm and Kroll.

Another portion of this blog is dedicated to the ID-theft stories and experiences submitted by I've Been Mugged readers. I learn a lot from your stories and your comments. Also, I expect to publish many more product and service reviews, which seem to be a popular topic.

And, who knows what else this blog will cover during the coming year? I'm sure that there will be some surprises and news nobody could predict.

Thanks for reading I've Been Mugged. I am honored that you take the time to read it out of your busy day.

If you haven't signed up for e-mail or RSS alerts, you can easily do so. The links are near the top of the right column.

Congratulations To Senator Obama; Coal To The TV Networks

Congratulations to Senator Clinton for her South Dakota victory. Congratulations to Senator Obama for becoming the presumptive nominee for the Democratic party. Now is the time to bring the party together and conquer "Bush McSame." Enjoy your day Senator Obama. Bask in your victory. You deserve it and you have earned it. Please give careful and deliberate thought to your choice for a VP running mate.

Now, a word about last night's coverage of this event by the television networks.

Here in Boston, I subscribe to basic cable. Only NECN broadcast Obama's speech in its entirety. Three of four TV networks (CBS, NBC, and Fox) and their local affiliates all presented standard programming which included reruns. ABC broadcast only half of Senator Obama's speech, and then the network anchor talked over the Senator before ABC cut to other programming.

Yes, there is the minor issue that the super delegates could change their votes. My point: at June 3, 2008 Senator Obama had achieved the number of delegates required for the Democratic nomination. Senator Clinton had not. Regardless, where was the TV network coverage last night>

What's up with this? Why such poor TV network coverage of this event? Is this the best that corporate owned media can do? Never before has this country had a woman and African-American candidates with a real chance of winning the presidential nomination of a major political party. Never before. And with Senator Obama's speech last night, never has an African American (of either sex) been the nominee with enough delegates to secure the nomination. That's history in the making by any measure.

Yet, no live coverage of the presumptive nominee's speech by the big four networks. Nothing. Zilch.

Disappointing. This poor coverage was not worthy of the broadcast licenses the 4 networks enjoy.

If they continue with this crappy coverage, I say pull their broadcast licenses.

Blogging For Civil Liberties Workshop at the ACLU of Massachusetts Conference

On Saturday January 26, 2008, I attended the first ACLU Massachusetts conference on Reclaiming Our Civil Liberties. The conference was a real treat for me, since I'd only read about Daniel Ellsberg, the keynote speaker. It was great to hear him live and hear his experiences about the Pentagon Papers. (See also the National Security Archive at GWU.) Ellsberg also discussed his views on the Bush administration, U.S. foreign policy, the Iraq war, the "Blue Dog Coalition" (for perspectives, see C-Span, Common Dreams , and the New York Times), and the oath of government officials to the Constitution (and not a personal oath to the President). Much of today's policies of expansive Executive privilege by the Bush administration are rooted in VP Cheney's tenure in President Nixon's administration.

I attended the conference both as a member and as a panelist. There were over 400 attendees, by my rough count. I spoke at a workshop titled, "Blogging for Civil Liberties." Christopher Ott, the Communications Manager of the ACLU of Massachusetts, chaired the panel. The other panelist was Charles Blandy, Co-Founder and Co-Editor of BlueMassGroup.com.

The workshop went smoothly. About 35 people attended this workshop. Charles spoke first and reviewed many of the well-known sites political blogs (such as Daily Kos and TPMmuckraker) consumers can use to learn about civil liberties and to participate in the blogosphere. My talk focused more narrowly on Ive Been Mugged as an example of citizen journalism, consumers' rights about identity protection, and notification laws after a corporate data breach. About 30 people attended this workshop and at least 400 attended the conference.

If you missed the conference, you can listen to the "Blogging For Civil Liberties" podcast (52 minutes, MP3 file, 23 MBytes). You can list to the podcast on any MP3 player, including the iPod. I'd like to thank Christopher Ott and the Massachusetts ACLU for making the podcast available. Thanks to Marilyn Humphries for the photograph.

[Note to readers: Sorry for the delay publishing this post. I would have published it sooner, but the podcast was only recently available.]

Screenshot Of The Day

From the Quantcast ratings web site:

In The Blogosphere: IT Project Failures and The Hartford's Data Breach

Whether or not you work in the Information Technology (IT) profession, IT Project Failures is a well-written blog. Michael Krigsman chronicles the missteps, mishaps, fumbles, and failures by IT departments in corporations and in government agencies. Michael is a good friend and I hope that more IT professionals read his blog and learn from the examples.

In a recent post, Michael wrote about a data breach at The Hartford insurance company. Data breaches are just one of the many types of IT department fumbles and mishaps.

The Hartford's data breach reminded me a lot of IBM's data breach earlier this year, when IBM lost my personal data. After reading the news reports in PC World and Cleveland.com (Note: State of Ohio Insurance Director Mary Jo Hudson is asking good questions), both companies' data breaches have some similarities:

1. Both companies lost backup data tapes
2. Both companies claim the data tapes were "lost" and that there's no evidence that the lost data has been misused
3. Both companies took more than a month to notify identity theft victims
4. The data tapes included sensitive personal data like SS#'s and driver's license numbers, and
5. Both companies offered the identity-theft victims one year of free credit monitoring

There are a couple differences. First, The Hartford was open and honest about the number of records exposed/stolen. To this day, IBM has never disclosed the number of records lost/stolen. It's difficult to trust a company that is not open and honest.

Second, The Hartford's data breach included lost/stolen customer information, while IBM's data breach included lost/stolen employee and former-employee information.

Now, back to the similarities...

It really seems dishonest when companies claim immediately after a data breach that there's no evidence of the data being stolen. First, the fact that they can't find the data tapes would be evidence enough. Second, identity criminals aren't going to announce that they've stolen or copied the tapes. Third, it'll be the identity-theft victims that discover the evidence, when identity thieves try to access their financial accounts or commit fraud in the ID-victims' names.

When companies make this claim of no evidence, they really need to be specific. Was their search for evidence only within the company? Did they approach law enforcement? Is their claim of 'no evidence' based on law enforcement's investigation?

Both companies seem to believe that one year of free credit monitoring is enough. It isn't. Identity theft victims have to monitor their financial and credit reports for a far longer time period than one year... like the rest of their lives. Both companies' data breach created this risk for the identity theft victims. So, the period of free credit monitoring should match the risk period.

In The Blogosphere: Chronicles of Dissent

A tip of the hat to the folks at Chronicles of Dissent blog for their coverage of my posts about correspondence with Attorney General Coakley's office about online breach notification. If you are a Massachusetts resident and you feel as I do, I hope that you'll contact Mass. Attorney General Coakley's office and tell them you want corporate breach notifications posted online.

In The Blogosphere: Savvy Gal

A tip of the hat to Wendy Darcy at her Savvy Gal blog for coverage of my posts about correspondence with Attorney General Coakley's office about online breach notification. Wendy posts some really helpful tips for working women about how to navigate the corporate world and their career.

Celebrating 3 Months - Top 10 Posts!

First, I'd like to welcome new I've been Mugged readers. About 90 days ago, I started this blog and so much has happened. This post explains why I started this blog.

To celebrate, I thought that I'd share the Top 10 Most Popular Posts based on what readers have viewed most:*

1. Kroll's Offering From IBM Deserves Scrutiny: an analysis of the IBM-arranged credit monitoring service from Kroll
2. What Does Your C.L.U.E. Insurance Report Say About You?: a report most consumers are unaware of, and information about Choicepoint
3. Data Breach Humor: we hope that IT and HR professionals don't manage data breaches like this!
4. TJX's Offer To It's ID-Theft Victims Deserves Scrutiny: several bloggers analyze TJX's out-of-court settlement and its offer to ID-theft victims
5. A Conversation With IBM (Part 1): I confront IBM with questions about its data breach and its corporate response
6. Apparently [the data tapes] fell off the back of a truck…: a review of the news coverage about IBM's data breach
7. Is TD Ameritrade Doing Right By Its Customers After Its Security Breach?: a review of TD Ameritrade's response to its data breach
8. Identity Thieves Operate Quickly: a case study involving a coworker
9. Opt-out Resources for Consumers: 4 resources every consumer should know and use to protect their identity
10. (Tie) New Hampshire Does It Right and Fraud Alerts: NH does something which few states do, and a discussion of the Fraud Alert tool and its weaknesses

* Thanks to Feed Burner and Google Analytics for making this report possible.

In the News

During the past few months, I've learned that after a data breach with sensitive personal data (e.g., name, address, birthdate, SS#), the affected company usually offers its affected employees, former employees, or customers one year of free credit monitoring service. An article in the Friday August 31 American Banker (AB) publication explored the best features for a credit monitoring service. The contents of that credit monitoring service offer seems to vary from company to company.

In the article, AB reporter Daniel Wolfe quoted several representatives from IBM, Kroll, Gartner (a market research company), Certegy, and me -- author of I've Been Mugged. Mr. Wolfe wrote a balanced article including a variety of perspectives about credit monitoring services.

In the article, representatives from IBM and Gartner emphasized that the value for ID-theft victims is with credit restoration services rather than credit monitoring:

"This is more than just credit monitoring," said Fred McNeese, an IBM spokesman, in an interview. "In the event that the loss was linked to credit theft, then it's working with Kroll to restore a person's identity." Avivah Litan, a vice president and research director at Gartner Inc., a market research company in Stamford, Conn., said most companies put little thought into nonstandard fraud monitoring services. She said IBM made a good pick in Kroll. "Credit restoration is very labor-intensive," and getting a credit report is not, she said."

No doubt. If identity thieves have stolen your personal data and have already hacked into one or more of your financial accounts (e.g., stole money, or gained credit or loans in your name), then yes -- you need help restoring your credit, your finances, and your identity. And credit restoration services are what an ID-theft victim needs in this situation.

If your data has been exposed by a data breach -- but nothing stolen or hacked yet -- then you need credit monitoring. There's nothing to fix or restore (yet). Credit restoration service becomes critical after identity thieves access your financial accounts and steal credit or money.

Credit monitoring is also important for ID-theft victims who are novices -- they haven't read their credit report recently, or never. Many people I've talked or traded e-mails with haven't read their credit report recently.

Yes, identity thieves operate quickly and the financial damage may happen within hours after the theft of personal information... making credit restoration necessary immediately. However, with corporate data breaches, it may take weeks or months for identity thieves to de-code encrypted tapes; or the stolen personal data may be resold among several thieves before it is used criminally. If you study the TJX data breach, you'll see that thieves who weren't the original hackers were arrested many months (or years) later; personal data clearly was resold among identity thieves in the US and in other countries. And, this theft fact extends the risk window.

I encourage I've Been Mugged readers to read the American Banker article online (registration required). To register, the AB site will ask you to either subscribe to the magazine or try the the 2-week free trial account option.

I wish that the article had given more focus on the duration of the free credit monitoring services offer. I haven't seen much discussion in the literature about what the optimal duration is. Usually, companies with a data breach offer one year of free credit monitoring services to affected individuals (e.g., employees, former employees, and customers). I haven't seen any literature or research about whether all affected individuals receive the same offer. I wonder if senior executives in the company receive the same credit monitoring offer as lower-level employees.

Mr. Wolfe's article accurately stated that I believe that the duration of free credit monitoring services should match the risk period... which is far longer than one year. Why? First, there's no time limit to how long identity thieves will (or will attempt to) abuse your personal data. Second, the company's data breach caused the risk, not the ID-theft victim's actions.

Any free credit monitoring services duration that is shorter than the risk period effectively shifts the burden (and the cost) from the company to the ID-theft victim. In the case of a company data breach, that burden-shifting is unfair, in my opinion.

What do you think? Is one year an appropriate duration for free credit monitoring services after a data breach? What do you think are the best features of a credit monitoring service? You can take our survey located in the column on the right.

Next entry: consumer attitudes about data breaches

In The News

InformationWeek Magazine's Security Weblog featured I've Been Mugged in an August 6, 2007 article titled "IBM Lost His Data... A Follow Up Story by Michael Singer. (The article also appears at Family and Twist.) Even though I'd written to InformationWeek via e-mail, I was pretty surprised by the attention I've Been Mugged received. Frankly, I haven't been blogging that long. So I'd publicly like to thank Mr. Singer for his article.

Mr. Singer's article emphasized many of the points from my July conversation with IBM. The Pogo Was Right blog also covered the InformationWeek article.

Some excerpts from InformationWeek's Security blog:

"George is an ID theft victim whose personal data was potentially exposed after an incident involving IBM. While IBM has graciously extended its hand to help fix the problem, George hasn't been completely happy with how things are turning out. His story may have lessons for the rest of us."

"IBM spokesman Fred McNeese was generous enough to answer that George previously worked for Lotus Development Corp. prior to IBM purchasing it. IBM's human resource records would have come over to IBM as part of the purchase. Fred also said that "Yes, IBM is still doing business with the vendor involved in the incident," but declined to go further."

Mr. Singer makes points which cannot be over-emphasized:

"But what have we learned by George's experience? First off, even if you no longer work for a company, it is very likely that your data will. And... your permanent record could wind up in the hands of another corporation and it may be months before you hear about your information being compromised. Does this mean that we all need to be diligent on how even our former companies are faring? That could be problematic in an environment where workers change jobs frequently and consolidation of companies has become commonplace."

"Secondly, hiring the same consulting company both for IBM's corporate investigation needs and as a credit-monitoring service is not illegal or unethical, but it may raise some eyebrows with the people you are trying to help."

Next entry: what does your C.L.U.E. insurance report say about you?