I've Been Mugged

Consumers Adapt Their Social Media Use Given Privacy Concerns

Pew Internet recently released the results of a second quarter 2011 survey about consumers' usage of social networking web sites and privacy. The survey found that consumers are adapting their usage of social networking web sites given privacy concerns:

• 63% of survey respondents have deleted people from their “friends” lists, up from 56% in 2009,
• 58% of users restrict access to their profiles on social networking websites. More women (67%) do this than men (48%),
• 48% of users have had some difficulty managing their profile privacy settings on social networking web sites,
• 44% have deleted comments made by others on their profile,
• 37% have removed their names from photos that were tagged to identify them, and
• 11% have posted content they regret.

It will be interesting to see how much further adaptation occurs in next year's survey results, since users will have had more time to use features, like the Timeline feature from Facebook. I have talked with consumers who use the Timeline feature to delete harmful archived status messages, since employers now use social networking web sites to screen job applicants, to determine credit worthiness, and to evaluate insurance worthiness.

Some consumers use the new Facebook Profile Preview feature to screen and reject their friends' attempts to tag them in status messages and photographs. That seems very wise since too many users (42% total) don't restrict access to their profiles.

Should companies use social networking websites for financial, insurance, and employment screening uses? That's debatable, but the reality is that companies use the data anyway for screening, and the social networking sites are happy to make more money. My advice: prune your profile of harmful archived posts, and don't post anything at a social networking web sites that you don't want read/shown in court.

Use Caution With Bill-To-Your-Cell-Phone Services

Lots of people like to try new services as they become available. It's generally a good idea as those new services can save time, effort, and/or money.

There is a good article at the Consumer Reports website which advises consumers to use caution when using bill-to-your-cellular-phone services. Perhaps, you have heard of the phrase: "digital wallet." There are several services available to pay with your cellular phone.

The magazine recently analyzed wireless carriers' contracts for bill-to-your-cell-phone services, and found:

"... consumer rights can vary widely between wireless carriers and the protections carriers claim to provide are often not spelled out in the contracts..."

The contracts outline consumers rights and responsibilities -- especially when bad things happen (e.g., bill problems, fraud). If the contracts aren't clear or complete, then you may encounter problems. The magazine used several secret shoppers to survey customer service representatives at:

"... Verizon, five from AT&T, and two each from Sprint and T-Mobile... Our test results show that, on average, cell carriers' customer service representatives are not aware of their company's policies."

Again, if the customer service representatives are unfamiliar with their employer's bill-to-your-cell-phone services, then you may encounter difficulty getting any bill problems resolved. Inspect your monthly bills closely for accurate charges.

Asurion Surveys Consumers About Their Smart Phones; Recycling Old Gadgets With Gazelle

Asurion, the provider of insurance services for mobile device users, announced on Tuesday the result of a recent survey of 3,000 smart phone users. Consumers are in love with their smart phones. Some survey results:

• About 30 percent of survey participants believe their smart phone is more helpful than their significant other: more entertaining or never talks back
• About half of survey respondents have sent racey text messages to their partners
• About 20 percent of respondents would not end a date if the other person spent the entire time on their phone

The survey included smart phone users in the United States. To learn more about Asurion, read this blog post.

If you desk drawer at home is filling up with old cell phones and electronic gadgets, then this may be an option for you. Gazelle, an electronics recycling company, claims that it will pay cash for old gadgets: cell phones, digital cameras, MP3 players, GPS devices, calculators, tablets, and more.

I haven't used Gazelle, so I don't know if it pays well and provides good data security. I'll bet that some I've Been Mugged readers probably have already used Gazelle. If you have, share your experiences below.

Javelin Research Reports Results About Bank Transfer Day

Finally, some firm statistics are being released about the results of Bank Transfer Day, when consumers moved their money from big banks to credit unions and local community banks. Based on extensive research, Javelin Strategy & Research estimated that 5.6 million U.S. adults moved their money during a 90 day period. Some details:

• 11% (610,000 of the 5.6 million) mentioned Bank Transfer Day as the reason they moved their money
• 26% said that high banking fees were the reason they moved their money

Javelin concluded that both Bank Transfer Day and the Occupy Movement had a measurable impact when compared to research results from prior years. So, a true grassroots movement can have an impact.

Previously, CUNA revised downward its estimates of Bank Transfer Day results due to a flawed methodology. CUNA did not change its estimate of more than 40,000 new credit union accounts opened by consumers on November 5, Bank Transfer Day.

Javelin designed the online research questionnaire and surveyed 5,878 consumers during December 2011. The survey process included:

"... targeted respondents based on representative proportions of gender, age, income, and ethnicity, and data was weighted to U.S. census proportions. The survey is based on a set of questions that were first fielded in 2003, and are now deployed on a twice-annual basis."

Javelin has research identity theft and fraud, with reports covering 2008 and 2010, plus trends in corporate data breaches. I have found Javelin's work reliable, but still await more results about Bank Transfer Day. It would be great to know the average bank account balance transferred, since the big banks seem to have focused on getting consumers to consolidate their accounts (e.g., checking, savings, and investments). The big banks are probably willing to lose consumers with smaller balances.

In a recent conversation with banking industry analysts, the Bank of America CEO reported a 20 percent increase in account closures during the fourth quarter of 2011.

Slowly, More Consumers Consider Website Privacy Policies Before Buying

PC Pro recently reported the results of a recent Forrester Research study. Forrester surveyed 37,000 consumers in North America, and found that a growing percentage of consumers consider companies' website privacy policies in their decisions about whether to do business with a company:

"Websites need to rethink their privacy policies as consumers ditch those that hide data rules or leak information, according to research from Forrester. The analyst found that a growing number of consumers were reading how companies dealt with their privacy and voting with their feet if they didn’t like what they saw."

More than half of survey respondents over 55 years of age said that they refused to complete an online transaction because of the company’s terms of use or privacy policy. In 2008, 40% answered this question the same way.

The PC Pro article would have been more helpful if it linked directly to the Forrester Research report and included more facts. The Forrester research study found:

"Individuals see different types of data differently -- they're most worried about what we consider individual identity data, and far less concerned about the capture and use of their behavioral data... Most consumers are willing to share their data in exchange for value. But, what they consider "valuable" is very age-dependent..."

If the article had included examples of well-crafted privacy policies, this would help consumers learn about what to look for in privacy policies -- at websites, social networking websites, and with mobile-device apps. In 2011, the European Union Justice Commissioner described four pillars of online data privacy, which is a good start for any corporate privacy policy.

In 2008, a brief review of the privacy policy at Mint.com prompted a huge discussion on this blog -- that still continues today.

The Personal Data Elements Consumers Want To Keep Private Online

At the All Things D blog, Liz Gannes has posted a very interesting inforgraphic about the data elements consumers care about and want to keep private online. The inforgraphic was created from a research report by Forrester Research. Some of the data elements and the percent of consumers that care about each item:

• 72% - Social Security number
• 71% - credit card number
• 62% - driver's license number
• 57% - credit score
• 52% - Internet browsing history

This was a good infographic. It would have been even better if it included consumers' GPS location history, since so many mobile phone companies, telecommunications companies, and social networking websites collect this data. When and where you go in the physical world is very valuable and equally sensitive data. It is a way of uniquely defining you.

CUNA Revises Downward Its Estimate Of New Accounts

An I've Been Mugged reader at the American Bankers Association provided a link to this December 6 American Banker article: Credit Unions Eat Crow On Customer Numbers. The article reported that the Credit Union National Association (CUNA) revised downward its initial estimate of the number of new accounts opened at credit unions by consumers who moved their money from large banks during the weeks leading up to Bank Transfer Day.

The CUNA is a trade association of 90 percent of 7,400 state and federally chartered credit unions serving about 93 million Americans. The CUNA originally estimated on November 3 that consumers opened 650,00 new accounts at credit unions from September 29 to November 2. The revised estimate is a third of the initial estimate: 214,000 new accounts at credit unions during this period. The American Banker article concluded:

"The [CUNA] association's scaling back of its numbers on Monday gave credence to banking industry officials and others who criticized the association's methodology last month."

The CUNA has admitted that its initial estimate was "rushed and flawed." The CUNA has not changed its estimate of more than 40,000 new credit union accounts opened by consumers on November 5, Bank Transfer Day.

I found the title of the American Banker article unnecessarily excessive: "Credit Unions Eat Crow On Customer Numbers." First, final new account numbers are not yet available, only estimates. Second, I hope that ABA members stay focused on the needs of consumers rather than this one-upmanship about a single flawed CUNA survey. If big banks truly were meeting consumers' needs, then this move-your-money situation would not exist. Banks have a lot of consumer trust to regain after huge credit card interest rate increases and alleged foreclosure abuses during the past two years. A recent consumer satisfaction survey found:

"Consumer satisfaction with credit unions has soared this year, posting scores well above their large-bank competitors, according to the 2011 American Customer Satisfaction Index... The satisfaction score for credit unions rose 8.7 percentage points to 87 points on a scale of 0 to 100. The index said it is the highest satisfaction score ever for any of the 47 industries."

Third, if you read about the genesis of Bank Transfer Day, it was a voluntary call by a person for consumers to move their money by November 5. Consumers can continue to move their money after November 5, and it may simply take consumers longer to move their money. Fourth, consumers value stability. This analysis suggested that credit unions survived recent economic crises better than commercial banks.

On December 1, the National Credit Union Administration (NCUA) agency reported performance results about credit unions during the third quarter of 2011:

"Membership and Total Assets Growth Continues: Despite a slight decline in number, federally insured credit unions added more than 450,000 members during the third quarter, growing to 91.4 million individuals. In all, membership has increased by almost 1 million during the first 9 months of 2011. Credit union total assets also continued to expand, standing at $951.1 billion on Sept. 30, an increase of almost $8.7 billion for the quarter... For the second quarter in a row, credit union lending increased to end the period at $567.1 billion, an increase of $3.1 billion over the prior quarter. New auto loans and other real estate loans continued to decline, while used vehicle loans, unsecured loans—including credit cards—and first mortgage real estate loans again all rose during the quarter. Notably, demand for non-federally guaranteed student loans jumped 20.5 percent during the third quarter to end at $1.3 billion on Sept. 30."

The NCUA report included only the 7,179 federally insured credit unions, and excluded results for October 2011 and Bank Transfer Day. I look forward to reading in January comprehensive actual results, not estimates, from all sources for all of 2011.

KPMG Survey: A Typical Corporate Fraudster Is...

KPMG recently released its 2011 Who Is A Typical Fraudster? report, describing the profile of a typical corporate fraudster, the impacts and amounts stolen, industries where fraud tends to concentrate, and the conditions which enabled the fraud. The report included 348 events in 69 countries. The fraud events included "white collar" crimes such as:

"... misstatement of financial results, theft of cash and/or other assets, abuses of expenses, and a range of other fraudulent acts."

The report excludes acts of no material value and misconduct.The report does not mention names. The average duration of the fraud was almost three and a half years from the start until its detection. In 74% of the incidents, fraudsters exploited weak internal controls. Companies fail to read and act quickly on the warning signs:

"The number of fraud cases preceded by a red flag rose to 56 percent of cases in 2011, from 45 percent in 2007... Just 6 percent of initial red flags were acted on in the 2011 analysis... Rarely is an act of fraud a one-off... In 2007, 91 percent of fraudsters were repeatedly fraudulent, compared with 96 percent in the 2011 analysis."

The average loss was $1.4 million in Asia Pacific, $1.1 million in the Americas, and $900k in Europe. The report described the following as one of the most interesting cases in the United States:

"At a U.S. financial institution, a larger-than-life chief executive surrounded himself with an inner circle of "yes men." The fraud, which involved subterfuge and complex bundling and unbundling of loans and transactions to make bad loans appear good... The investigation quickly uncovered conflicting stories told by the CEO's inner circle and the people working with the loans and customers. This case illustrates, in particular, how dominant and bullying behavior can coerce others to participate in fraudulent activity."

The corporate fraud includes identity theft. A case from Switzerland:

"Fraudsters attempt to extract money from dormant accounts or they assume the identity of a customer to trick advisers into making payments or transfers. Often this involves the collusion of an external party with an internal ally..."

I also found the consequences interesting:

• Disciplinary action: 40% of cases (54% in the Americas; 23% in Asia Pacific)
• Regulatory, legal enforcement: in 45% of cases
• Civil recovery: 23% of cases
• Resignation/voluntary retirement: 17% of cases (25% in Asia Pacific)
• Out-of-court settlement: 6% of cases
• No action taken: 3% of cases

The profile of a typical corporate fraudster:

• Male (87% were men)
• 36 to 45 years of age (41% were ages 36 to 45; 33% were ages 45 to 55)
• Committed the fraud against his own employer (90% committed the fraud against their employer)
• Works in the finance function or in a finance-related role (32% worked in finance; 26% were CEOs; 25% were in operations/sales)
• Holds a senior management position (29% were in management; 53% were in senior management)
• Employed by the company for more than 10 years (33% employed more than 10 years; 29% employed 3 to 5 years; 26% employed 6 to 10 years)
• Committed the fraud in collusion with another employee (61% acted with others)

The report mentioned this about collusion:

"... male perpetrators (64%) are almost twice as likely to collude than women (33%). After taking account of male dominance in the perpetrator group, collusive females account for just 4 percent of activity. Perpetrator groups are most typically all-male or mixed gender."

KPMG is a tax, auditing, and advisory firm operating in 144 countries. A KPMG auditor caused a data breach in May 2010 when the auditor lost a flash drive containing 4,500 unencrypted patients records.

How Secure Are Today's Smart Phones?

Smart phones are popular. An estimated 55 percent of consumers buy them, up from 34 percent in 2010. For the latest three months ending May 2011, the share of the smart phone market is dominated by Google/Android (38.1%), Apple/iOS (26.6%), RIM (24.7%), Microsoft (5.8%), and others (4.8%). Companies are racing to replace consumers' credit cards and cash with mobile wallets (a/k/a mobile payments) on smart phones.

My wife bought me a smart phone in December as a Christmas present. My Windows Phone is very convenient. The camera, handling of multiple e-mail accounts, ESPN ScoreCenter, Twitter, Ars Technica, and BBC News apps are my favorites. However, I have a love-hate relationship with my smart phone.

The interface is inconsistent across apps. Different apps use different buttons and controls. Some apps automatically collect updates using my data plan, and others let me control the refresh/update. The voice-activated Bing search on my phone is great, but I don't have yet Google/Bing searches integrated with McAfee SiteAdvisor on my smart phone as I do on my laptop.

While browsing various websites with my smart phone, I often see a warning message that my phone uses an obsolete web browser. While browsing Marketplace Hub for new apps to download and install on my smart phone, I have noticed that some apps have privacy policies and many don't. Not good.

When I start to think about poor smart phone data security, apps lacking privacy policies is one example. Apps that lack privacy policies make no promise or commitment to consumers about how that app (and its developer) will protect, use, sell, and/or share consumers' data collected by that app. Nor does the app make any promises about what data it will, or won't, collect and transmit back to the app developer.

I don't install apps that lack a privacy policy.

I have also noticed that several privacy policies apply. There are separate privacy policies from the phone manufacturer (HTC), the operating system developer (Microsoft), the telecommunications provider (AT&T), and each app developer. Simplicity and integration would be a huge benefit. A single, comprehensive privacy policy would be better. The current multitude of policies makes it difficult for consumers to assess how private (and secure) the information on their smart phone really is.

After discussing this with friends, my phone experience doesn't seem much different from other brands: Apple/iOS, and Google/Android.

All of this leads me to wonder how secure smart phones really are. So, I've started to compile a list of smart phone data security statistics. According to Infosec:

"Existing mobile operating systems are under attack... Current research is primarily geared towards securing mobile payments, but there is a lack of coordination between mobile payment developers, device manufacturers, and mobile operating system platform developers. Hackers are taking advantage of the loophole created by this lack of coordination."

The New York Times reported on another measure of smart phone (in)security:

"Phishing is also a growing problem on all smartphone platforms... Mobile users are three times more likely to fall for these scams than PC users, according to statistics on phishing recently gathered by one security company, Trusteer. The company believes that is because mobile devices are activated all the time, and small-screen formatting makes the fraud more difficult to spot. It cautions people not to click on Web links in messages."

In prior blog posts, I have reported about class-action lawsuits against OpenFeint and Apple which included allegations of unauthorized tracking and data collection by apps of consumers' sensitive personal information. That is another measure of smart phone data security (or lack thereof).

Since there are reportedly 200,000+ apps in Apple's App Store, 70,000+ in Android's Market, and 25,000+ apps for Windows phones, I spent some time reading app-related studies.

In October 2010, researchers at Intel Labs, Penn State, and Duke University released results of their study of Google/Android apps. The researchers randomly selected 30 apps from the 358 most popular free apps in Android market, and developed a method called TaintDroid to track what private information was shared. The researchers found:

"In a study of 30 popular applications, TaintDroid revealed that 15 send users' geographic location to remote advertisement servers. The study also found that seven of the 30 applications send a unique phone (hardware) identifier, and, in some cases, the phone number and SIM card serial number to developers."

The researchers also studied notification of consumers, because privacy violations can occur when data is used in unexpected or unauthorized ways. The researchers also found:

"... the install-time permission checks do not indicate to the user how these services and data will be used. There is no way to determine simply from the set of permissions how data will be used, and in some cases misused. Users can also be notified of an application's behavior via a license agreement that is displayed on first use. With one exception, we found the user license agreements in the studied applications, if present at all, do not provide any additional information on how data is used."

In June 2010, SMobile Systems (now Juniper Neworks) released the results of its study about Google/Android apps (PDF):

"... one in every five applications request permissions to access private or sensitive information that an attacker could use for malicious purposes. One out of every twenty applications has the ability to place a call to any number without interaction or authority from the user. More frighteningly, 29 applications were found to request the exact same permissions as applications that are known to be spyware and have been categorized and detected as such by SMobile’s solution. A full eight applications explicitly request a specific permission that would allow the device to brick itself, or render it absolutely unusable. 383 applications were found to have the ability to read or use the authentication credentials from another service or application. Finally, 3% of all of the Market submissions that have been analyzed could allow an application to send unknown premium SMS messages without the user's interaction or authorization."

SMobile concluded (bold emphasis added):

"... the fact remains that there is no means available for a user to know for sure that the app they just downloaded is doing only what the user sees it doing. One must look at the permissions it has requested to determine what the application's true capabilities might be."

These permissions are the actions an app could perform: make a phone call, send an SMS/text, send an e-mail, transmit data, save/edit/delete a file in the smart phone's memory, modify a phone setting, access a smart phone feature (e.g., camera), and so forth.

Another measure of data security has been document by the News Of The World and News Corporation phone-hacking scandal. The Boston Globe explained well the vulnerability from "caller ID spoofing" combined with the lack of voice-mail password access by most mobile carriers:

"... caller ID spoofing, which can make a call appear to be coming from any phone number. Hackers can use it to access someone else’s voice mail messages by fooling the system into thinking the call is coming from the owner’s cellphone... Three of the four major US cellphone carriers - AT&T, T- Mobile, and Sprint - do not require customers who call voice mail on their own phones to use a password to listen to messages, making them vulnerable to malicious spoofers. That is a serious shortcoming..."

Smart phones don't seem nearly as secure as I though before compiling the above list of statistics. There seems to be several ways to assess smart phone data security:

• Consistency of privacy policies across the manufacturers, service providers, and app developers
• Presence of privacy policies across apps
• Compliance rates by app developers with an app store's security policies and guidelines
• Whether app privacy policies disclose both data collected and how that data will be used
• Whether apps collect and transmit data beyond the privacy policy disclosure
• Whether apps perform permissions beyond what the user sees or is stated in the privacy policy
• Whether apps perform actions (e.g., transmit e-mail, SMS/text, or data) without first notifying users and gaining authorization. Some of these actions can produce charges on consumers' monthly mobile bills
• Whether apps collect and transmit data to third parties (e.g., advertisers, manufacturers, affiliates)
• Whether apps that mimick known spyware's features and behaviors are indeed acting as spyware
• Malware installed secretly on consumers' smart phones by phishing attacks via websites, email, text/SMS
• Whether the telecommunications carrier provides a secure access to voice-mail with a password, and builds this into the app on the smart phone

Besides this list of discrete data security measurements, there is an overarching consideration. Today's mobile devices (e.g., smart phone and tablets) are pre-programmed and designed by manufacturers to be always tethered to some telecommunications service, unlike traditional desktop and laptop computers which can be configurred to operate with any of several telecommunications networks chosen by the user. The Observer concluded:

"... we are on the slippery slope towards a much more controlled, less open, internet. If these trends continue, then it won't be all that long before a significant proportion of the world's internet users will access the network, not via freely programmable PCs connected via landline networks, but through tethered, non-programmable information appliances (smartphones) hooked up to tightly controlled and regulated mobile networks... The danger, in other words, is that we move from an internet designed for people to a networked tailored only to the needs of corporations."

It seems to me no accident that mobile the device manufacturers use the term "jail-break" to describe consumers' desire to use mobile devices on the telecommunications network of their choice (and not the manufacturer's choice). My view: the Internet was designed to be flexible for users to explore and to innovate. Otherwise, why bother?

What's your opinion about smart phone data security? What studies have you read?

Smart Phones Still Don't Deliver The Privacy, Data Security, And Trust Consumers Want

Consumers love their smart phones. Over at Column Five Media, there is a really good infographic that displays the problem with today's smart phones. Some of the key statistics highlight the problem:

• When using their smart phones, 99% of consumers consider their privacy as Extremely Important, Very Important, or Important
• 99% of consumers rate knowing what data their smart phone apps collect as Extremely Important, Very Important, or Important
• 99% of consumers rate access to controls about what information is shared as Extremely Important, Very Important, or Important

Yet, trust isn't there yet. Not for any of the brands. The portion of consumers who feel safe with each brand smart phones:

• Apple/iPhone: 28%
• Blackberry: 28%
• Google/Android: 22%
• Windows Mobile: 18%
• All Other brands: 12%

From what I have read, the above statistics include adults as teens give little to no thought, consideration, or priority to privacy. Google/Android users may find the My Data Manager app helpful at tracking what data your apps collect and share. Read the entire Lookout Mobile Security inforgraphic.

Received Poor Customer Service? How To Complain Effectively

Recently, Consumer Reports published the results of its survey about customer service by several retailers. Many companies' customer service operations rated poorly. Consumers often left the store (or website or hung up the phone) in frustration without getting heard or their issue heard or resolved.

Consumers should not have to sue a retailer to get a response or the services they paid for. The CR report offered several suggestions for consumers to complain effectively to get heard and ideally get your issue resolved:

1. Give praise: explain what the retailer did well. Whether on the phone or in-person, give the good news first and the bad news second. The customer service representative is human, is more likely to hear and act.
2. Stuck in voice-mail hell? Consult websites such as such as dialAHuman.com and getHuman.com for the customer-service numbers to exit voice-mail to access a live representative.
3. Keep a written record of the situation or problem. Keep any receipts. Make notes of the customer service representative's name, phone number and extension, date and time of your call -- or attempted call. If the representative provided a confirmation or service-request number, keep a record of that, and use that number later when following up online, via snail mail, or via phone.
4. Escalate appropriately: if you have tried the above tactics without success, escalate the issue to the representative's supervisor. If you can't get resolution, politely ask the customer service representative to get his/her boss on the phone line.
5. Don't give up. Speak firmly. Post your story on social-networking sites. Contact a consumer-advocate blogger. There are many around the country. If you use Twitter, use hashtags (examples: #custserv #fail; #sears #fail) to make your tweets searchable. 

Do You Trust CEOs and Company Breach Notification Letters?

Recently, Fast Company published a news item about the public's trust in various institutions. The main point: from 2009 to 2010 trust in CEOs was greater than trust in "persons like yourself" for the first time. The key graphic:

I found this hard to believe after the Madoff scandal, the BP oil spill, the recession, the public's anger towards banks, the huge credit card interest rate increases, the bailouts, and huge bank executive compensation. If we believe this Edelman study, then we consumers still trust CEOs, including those at banks, more than we just people who are similar to ourselves.

I'll ask the question a little bit differently. When you receive a breach notificaiton letter via snail mail:

• Do you really trust that the company (and its CEO) did everything possible to protect your sensitive personal information, which it has since lost or had stolen?
• Do you trust that the breach notification fully explained what happened and the risks to you?
• Do you that the company will openly, honestly, and directly tell you the results of its breach investigation?
• Do you trust that the company has taken all appropriate steps to implement data security methods to prevent another data breach?

For those readers who are social networking and smartphone users:

• Do you trust the the social networking site will adequately protect your personal information?
• Do you trust the social networking site fully disclosed all of the other company it sold your personal information to?
• Do you trust the social networking site to adhere to its privacy policy?
• Do you trust the apps at the social networking site to protect your personal information?
• What about the apps on your smartphone or tablet?

Over-Sharing During The Holidays

One important thing I try to do in this blog is to remind consumers of good data security habits. A recent "Connected But Carelesss" study of 1,000 Internet users in the United States, sponsored by Symantec Norton and conducted by Javelin Research, found that many consumers are lax about the security of their information while online:

"... consumers are still somewhat cavalier and under-informed when it comes to Internet security, specifically in three areas: location-based services, mobile phone transactions, and online passwords."

Just under half (47%) of the consumer survey participants respondents said they expected their online purchases to increase between the Thanksgiving and New Year's holidays. About a third (31%) between the ages of 18-34 said they expected their social networking activity to increase during the same period.

Location-based status messages, or telling people real-time where you are via your mobile device, is a leading risky behavior when consumers share too much:

"... 15% of people surveyed knew enough about geo-location to be able to explain it... 22% who use their mobile or smartphones to connect to the Internet, admitted to giving applications on those devices permission to identify their location... 56% under the age of 35 said they update their social networking status with their location, which can inadvertently broadcast to real-world criminals that they’re not at home."

A second risky behavior is that consumers take for granted that their mobile devices are secure. While 38% of survey respondents use a mobile device or smartphone to check bank accounts and 51% post updates on social networking sites:

"... one in four people accessing the Internet this way aren’t sure, or haven’t even thought about, what’s safe mobile practice, while another 42 percent have only a “general idea” of what constitutes safe practices. In addition, 52 percent of those people accessing the Internet via their mobile devices don’t use the basic level of protection of having an access password in place..."

I have repeatedly discussed in this blog the need for strong passwords. More results from the Norton study:

• 46% said they never change their password on their e-mail account
• 31% said they never change their password on banking and financial accounts
• 42% said they never change their password on social networking sites
• 71% of survey respondents who have one password across different accounts/sites say they do so because it is easier

Identity thieves and spammers are probably happy to read these survey results. Experts advise consumers to do the following to protect your identity and financial information:

1. Password-protect your mobile device or smart phone: add a password so nobody else can access the information in your mobile device
2. Consider a "remote-wipe" feature for your mobile device. Norton offers a Mobile Security application for Android users to remotely lock or wipe data when their phone is lost or stolen.
3. Think before using your personal mobile device for business. Check for your employer's mobile device policy, as some employers use remote-wipe features which will delete everything in your smart phone
4. Think before logging in: assume that public WiFi connections are risky with communications monitored, whether you use a laptop, smart phone, or other mobile device. Avoid becoming a sidejacking victim. Never enter sensitive bank account information, debit card or social security numbers when browsing the Web via a public Wi-Fi connection
5. Use one credit card specifically for online purchases. It makes it easier to spot any fraudulent items, and limits your liability if your card number is stolen. Don't use a debit card
6. Update the anti-virus software on your laptop or desktop computer
7. Change your passwords at least once every 90 days. Use strong passwords
8. Don't use the same sign-in credentials and password for all of your online accounts and email accounts. Use different passwords. The recent Gawker breach highlighted this risk.

Happy holidays!

Survey Results: Norton 2010 Cybercrime Report

Last week, Norton released its 2010 Cybercrime Report. The main finding is that cybercrime is a huge, worldwide problem:

"For the first time, this report reveals that nearly two thirds of adults globally have been a victim of some kind of cybercrime (65%). Cybercrime hotspots where adults have experienced cybercrime include: 83%, China; 76% Brazil/India; 73% USA."

What is "cybercrime?" Cybercrime includes:

"Computer viruses and malware attacks are the most common types of cybercrime people suffer from, with 51% of adults globally feeling the effects of these. In New Zealand, Brazil and China it’s even worse, with more than six out of 10 computers getting infected (61%, 62% and 65% respectively). Adults around the world have also been on the receiving end of online scams, phishing attacks, hacking of social networking profiles and credit card fraud."

Readers can download one or several several country-specific versions of the report. I downloaded the United States version. Some of the detailed findings:

• 73% of adults in the USA (compared to 65% of adults worldwide) reported experiencing some form of cybercrime
• 2% of adults in the USA (compared to 3% of adults worldwide) expect to not be a victim of some form of cybercrime
• 78% of adults in the USA (compared to 79% of adults worldwide) expect cybercriminals will not be brought to justice
• In the USA, 67% of adults are angry about it, and 59% are frustrated. Worldwide, the comparable statistics are 58% and 51%
• When asking for help, in the USA 59% of adults call their bank, 54% change their behavior, and 44% call their Internet Service Provider (ISP). Worldwide, the comparable statistics are 51%, 48% and 44%
• In the USA, the average cost to resolve cybercrime is $128 and 24 days. Worldwide, the comparable statistics are $334 and 28 days.
• 25% of adults in the USA (and 31% worldwide) reported not being able to resolve cybercrime.
• 51% of adults in the USA (and 45% worldwide) believe that you can never restore an online reputation after a cybercrime event

The online survey was conducted February 2-22, 2010 for Symantec Corporation by StrategyOne, an independent market research firm. The survey included 7,066 adults aged 18 and over in 14 countries (Australia, Brazil, Canada, China, France, Germany, India, Italy, Japan, New Zealand, Spain, Sweden, United Kingdom, United States). The survey used the primary language in each country.

Only 9% of adults worldwide feel very safe online. Combine that statistic with any of the above findings about expecting to be a victim, criminals not being brought to justice,, feelings of anger, and the cost of resolution and you have a very sad commentary on the state of today's Internet.

The report confirms something I have said for a long time. Consumers demand control over their sensitive personal information -- the number one rule consumers in the USA use as a solution to protect themselves online. In the USA, the leading "common-sense rules" consumers in the USA use to protect themselves online are:

• 79% safeguard personal information
• 78% never disclose online passwords
• 78% don't open email/links from strangers
• 78% are skeptical of offers that seem too good to be true

This blog contains plenty of resources to help consumers stay safe online. To learn more, click on the "List of Lists" or "Reviews" links in the horizontal navigation bar at the top of this page. If you use Facebook.com, you see the list of blog posts in the Facebook module in the near-right column.

FTC Seeks Consumer Comment on Consumer Fraud Survey

The U.S. Federal Trade Commission (FTC) seeks comments from the public about a planned survey on the frequency of consumer fraud in the United States. The FTC performed this survey previously in 2003 and 2005. A major finding in the 2005 survey (5.1 MBytes, Adobe PDF document) was:

"An estimated 13.5 percent of U.S. adults – 30.2 million consumers – were victims of one or more of the frauds covered in the 2005 fraud survey during the year before the survey was conducted (Table 2). There were an estimated 48.7 million incidents of these frauds during this one year period.

The FTC proposes to survey by phone consumers aged 18 and older with a nationwide randomly-selected sample. The agency says that the survey results will help it determine the rates of consumer fraud, the makeup of types of consumer fraud, and how to fight consumer fraud. The last survey found that the most frequent types of fraud included fraudulent weight-loss programs, fraudulent foreign lotteries and buyers clubs, fraudulent prize promotions, and fraudulent work-at-home programs. The types of victims varied:

"Eighteen percent of Hispanics and 20 percent of African Americans are estimated to have been victims of one or more of the frauds covered by the survey. The rate for non-Hispanic whites was 12 percent..."

A chief factor that made some consumers more vulnerable to fraud:

"Consumers who indicated that they had more debt than they could comfortably handle were more likely to be victims of fraud than those with less debt. Almost one quarter of those who indicated that they had more debt than they could comfortably handle were victims of one or more of the survey frauds..."

It will be interesting to see how the economic recession and home foreclosures during the past two years affects the next survey's results. And, there are several new technologies and mobile devices that didn't exist five years ago.

The deadline for submitting comments is November 1, 2010. Consumers can submit comments online at a secure FTC website, or via postal mail to:

Federal Trade Commission
Office of the Secretary, Room H-135
(Annex J), 600 Pennsylvania Avenue, N.W.
Washington, DC 20580

Written comments should reference the "Consumer Fraud Survey 2010, FTC File No. P105502" so that consumers' comments are accurately collected. Because the FTC makes public all comments it receives, your submission should not include any sensitive personal information, such as your Social Security Number, birth date, driver’s license number or other state identification number, passport number, financial account number, and/or credit or debit card number. Your submission should not include any sensitive medical information or trade or secret business processes.

Javelin 2010 Identity Fraud Survey Results

I spent some time recently reading the results of the Javelin Research 2010 Identity Fraud Survey (PDF, 453 K bytes). During the past six years, Javelin Research has surveyed about 30,000 adults to track the volume of identity theft and fraud incidents. The latest survey during 2009 included about 5,000 adults in the USA.

For new readers, there is a difference between "identity theft" and "identity fraud." The former is when an unauthorized person accesses your sensitive personal information. The latter is when the criminals use stolen identity information to steal money, obtain credit, or impersonate another person during a crime. Most of the time, I use "identity theft" in this blog to cover both theft and fraud.

How identity theft occurs:

"... among the victims who knew how their data was taken, lost or stolen wallets, checkbooks, or credit cards accounted for nearly two times as many instances of theft as all online attack methods combined."

How identity criminals fraudulently use stolen personal data:

• 42% - make purchases in person
• 42% - make purchases online
• 21% - make purchases via phone or postal mail
• 10% - withdraw money from ATM machines
• 10% - write checks
• 6% - buy prepaid gift cards

This criminal fraud is influenced by the fact that often credit cards are stolen. In 2009, more han 11 million adults were identity fraud victims.

The survey report's authors advise that the most effective way for consumers to protect themselves from identity fraud is to monitor their accounts online for unauthorized purchases. That means checking your bank accounts and phone bills online. If you see unauthorized transactions, notify the bank (or phone company) immediately. If your credit/debit cards and/or checks were stolen, notify your bank immediately.

It will become increasingly important for consumers to monitor their wireless phone bills as phone carriers add payment services to smart phones. About online shopping, the survey report's authors advise consumers to:

"... take additional precautions to protect their payment and personal information. Enrolling in Verified by Visa or MasterCard SecureCode, which allows you to have an additional password when making purchases online, offers consumers greater security. There are also programs such as Trusteer’s Rapport and IDVault offered by financial institutions, which can alert users when they enter a website for the first time, thus creating an additional layer of security to prevent users from entering their information into a fraudulent site."

About social networking sites, such as Facebook, Twitter, and MySpace), the survey warns consumers that identity criminals can harvest your sensitive personal data you share online and then use it against you to:

"... take over accounts or open fraudulent accounts. Users should not store or reveal personal contact information, including phone numbers, Social Security number, date of birth, e‐mail addresses, physical addresses, mother’s maiden name, or other information that could potentially allow a fraudster to obtain sensitive information or hints to passwords."

So if you mention your favorite color on pet online, don't use that color or pet's name as one of your online passwords. It is obvious: don't post your bank accounts online or in an email message. And, don't post online the sensitive personal information of your family and friends.

I have blogged previously about the risks of displaying your birth date on social networking sites, but too many of my online friends continue to display it based on a fear that their friends won't send them birthday wishes. Hello?! Your true friends know your birth date already. And, do you want volume or quality? Unfortunately, fear often outweighs good data security habits.

If you are a victim of identity fraud, it will take time and money to repair your credit and resolve the fraud:

"Out‐of‐pocket costs can include unreimbursed losses, lost wages due to time taken off work, and possible legal fees for those victims attempting to prosecute... Most victims don’t experience any out‐of‐pocket costs, but those who did suffered an average cost of $373. The average time to resolve the fraud for these victims was 21 hours."

Remember, your mileage may vary with credit resolution. Identity fraud involving your stolen Social Security Number or online bank account sign-in credentials is far more complex than a stolen credit card.

The report also listed several tips for consumers to avoid identity theft and identity fraud, which I have covered often in this blog:

• Keep the anti-virus and anti-spyware software on your home computer active and updated. Use anti-phishing software, too.
• Don't disclose sensitive personal data on social networking sites. See the above list of items
• At social networking sites, keep your online profile private. Read the website terms and privacy policies
• Use strong passwords online and not these
• Don't leave financial information and bills lying around the house. Store them in a secure place
• Opt out of pre-approved credit offers sent via postal mail
• Use a secure Internet connection (especially wireless users)
• Be aware of your surroundings. Cover the keyboard at ATM machines. If there are strangers lurking, don't enter your passwords to bank accounts when using your laptop
• If you are a victim of identity fraud, learn about the differences between fraud alerts and security freezes for your credit reports

High School Seniors Need Help With Money Management

I recently wrote about identity theft tips for college graduates. It seems that things are worse with high school seniors.

According to a recent survey by Capital One Financial Corporation, high school seniors benefit greatly from financial education both in the home and at school. Either one alone is not quite enough. The survey found that those seniors with financial education both at home and at school felt significantly more confident about their personal finance skills and knowledge.

The survey also found that nearly half (45 percent) of all high school seniors surveyed said they are unsure or unprepared to manage their own banking and personal finances. Compare that to this: of the students who had a personal finance class 75 percent said they felt prepared to manage their finances. Another 66 percent rated themselves "highly" or "very" knowledgeable about personal finance, compared to only 30 percent for high school students who didn't have a financial education course.

If this is how high school students without a financial education course rated their confidence, the percentage must be similar for those who haven't learned about identity theft and fraud.

Parents Involvement Matters

The survey also found:

• 20 percent of high school students said that they "frequently" discuss money management and personal finance issues with their parents
• 45 percent said they "sometimes" discuss money management and personal finance with their parents
• 34 percent said they never discuss money with their parents, or only when necessary
• Of students that reported frequent discussions, 71 percent rated themselves as "highly" or "very" knowledgeable about personal finance, and 81 percent feel prepared to manage their own finances

Having a Job Helps

The survey also found that having a job during high school helps prepare high school students to manage their money and finances. Of the high school student who already had a job, 72 percent said that their job experience prepared them in some way.

To help parents and young adults, Capital One partnered with Search Institute to create a free multimedia financial literacy program at www.bankit.com. The program helps parents and teens learn practical skills together and avoid common mistakes.

Tracking Your Online Habits and Privacy: Huge Problems Persist

While much attention during the last few weeks has focused on Facebook and privacy, there is a far bigger privacy issue facing consumers online. It involves a technology that many websites use and few consumers are aware of.

Many websites try to present relevant advertisements based on pages you have viewed in that site, or your past purchases. Perhaps you have noticed this. My wife said she noticed more ads for flowers online after she has just bought some flowers online. She knows intuitively that something is going on behind the scenes; that her information is being shared somehow. The specific technology is a mystery to her and to many consumers.

Maybe you like relevant ads; maybe you don't. How do websites present relevant ads? One method is your sign-in credentials. When you visit a site and enter your ID and password to sign in, the website knows it's you and can track your movements within its site. That's fine and dandy. If you don't want to be tracked, don't sign in to that site.

Some websites serve up relevant ads without requiring you to sign in. How do they do this? One method is a technology called web browser cookie files or "HTTP cookies." An HTTP cookie file is a small amount of text saved in a file located on the hard drive in your computer; in a folder with your web browser software (e.g., Firefox, Safari, Internet Explorer, etc.). Many websites use HTTP cookies because it's a way to identify you; to save in an HTTP cookie file an identifier so the website can tell if you are a new or returning visitor; and to track your online movements within their website to present relevant ads based on the pages you viewed within their site.

So if you visit a clothing site online and shop for shoes, it may save a code to the HTTP cookies file indicating when you first visited the website and the shoes site section viewed, so the website can present to you more shoe ads while you view other site sections with pants, coats, boots, or whatever. Some consumers like for the websites they visit to present relevant ads. Some consumers don't.

I have worked in the website design industry since 1997 primarily as a user experience and information architecture professional. I've built, as part of a design team, both large and small websites. Whenever we were building a website that included personalization, the topic of HTTP cookies versus sign-in credentials always came up. The method we used -- sign-in credentials, HTTP cookies, or something else (hint: keep reading and you'll learn what that is) was always a balance between the website design goals, users' needs, the client's budget, the preferences of the web developers, and the technological capabilities of the client's Information Technology' department.

In 2007, a study found that about 30% of consumers regularly delete the HTTP cookies on their computers. These consumers value their privacy and prefer to retain as much control as possible of their personal information. Why consumers take the time and effort to delete HTTP cookie files:

• Some websites use "session-based" HTTP cookies: information about you is stored in the HTTP cookie only for the time period while you visit the website. When you leave that website, the information stored in the HTTP cookies is deleted.
• Some sites uses "persistent" HTTP cookies: the site edits the HTTP cookie so it retains information for later use tomorrow, next week, next month, next year or whenever you return to that site.
• Some companies buy and sell the information saved in HTTP cookies at "behavioral exchanges."

You can use your web browser software to delete HTTP cookies manually or set it to automatically delete HTTP cookies at a predetermined schedule. For example, in the Internet Explorer menu bar select:  Tools --> Internet Options --> Browsing History Delete to view the automatic and manual options.

In May 2009, I performed an informal analysis of the HTTP cookies files used by Experian and Equifax: two of the three major credit reporting agencies. In that analysis both credit reporting agencies and their advertisers saved information to HTTP cookies on my computer as soon as I visited each web site's home page. Why? To track my online movements within each site, to determine if I was a first-time or returning user, and which ads I had viewed. Based on that knowledge, they could charge their ad clients based on a more accurate measurement of online usage by me and all other consumers visiting each site.

What I found disturbing from that analysis was that both credit reporting sites started tracking my online usage before I had a chance to read each website's Terms of Conditions and Privacy policies to learn how each web site and its advertisers track my online movements. So consumers should know that tracking via HTTP cookies starts immediately when you go online.

The recent concerns about privacy at Facebook is that Facebook wants to, a) make public personal information many consumers want to keep private, and b) track your online movements and serve up relevant ads when you visit other websites; not only at the Facebook site. This is part of a trend online today.

Since that study showed that a significant number of consumers delete the HTTP cookies on their computer monthly, advertisers have sought a more reliable tracking method that wasn't vulnerable to deletion by consumers. It seems that they have found a solution with the Adobe Flash Player software which creates its own cookie files, commonly referred to as "Flash cookies" or "Local Shared Objects" (LSO).

Adobe Flash is the technology many websites use to deliver an interactive, animated website experience, content and ads. Adobe Flash Player is the free software installed with your web browser software so you can view content at websites that use Adobe Flash. Perhaps you have seen the Adobe Flash player image on the right. Adobe is the company that owns the technology and distributes the Flash player software.

You don't have to install Adobe Flash Player on your computer, but most people do because it provides a better online experience at websites that present content with Adobe Flash -- a popular technology among website designers. The Adobe Flash player software stores a "Flash cookie" file on your computer in a different file folder location which web browser and online-ad-blocking software don't access and delete.

One benefit to advertisers is that they can set Flash cookies to never expire. Another appeal is that they can store a lot more information. An HTTP cookie stores a maximum of about 1,024 bytes of information; compared to about 5 megabytes maximum for a Flash cookie. You don't need to be a rocket scientist to see which is better at collecting massive amounts of consumers' personal data and Internet habits.

Like any other technology, some websites use Flash cookies responsibly, while other sites abuse consumers' privacy with it. The problem is:

1. Few consumers know about Adobe Flash,
2. Even fewer consumers know about Flash cookies,
3. Few to no websites inform users that their websites use Adobe Flash cookies,
4. It's the wild west on the Internet and their are no rules or regulations about this, and
5. Some websites use Flash cookies to permanently store information about consumers to avoid HTTP cookie deletion by consumers.

The problem is not new. In July 2009, I first wrote about privacy concerns with Flash cookies. To control the information Flash cookies store about you and your online habits, at that time I advised consumers to use the "Flash Privacy and Settings Control Panel" tool available at the Adobe website. I have since learned that advice is only a partial solution.

In a study last year, researchers at the University of California Berkeley analyzed the use of Flash cookies at the top 100 web sites. The researchers found:

• 98 % of the websites analyzed use HTTP cookies; 54 % use Flash cookies
• Of the websites using HTTP cookies, each site uses on average 36 different HTTP cookies
• Of the websites using Flash cookies, each site uses on average 5 individual Flash cookies
• The websites using Flash cookies included the private sector and government
• A significant percentage of sites used Flash cookies to store the same information as HTTP cookies
• The content in Flash cookies is stored by both the organization that operates the website and third-party organizations (e.g., advertisers, website measurement firms)
• Some websites use Flash cookies to programatically recreate HTTP cookies that the consumer has previously deleted
• Many websites that use Adobe Flash are TRUSTe certified
• The "Private Browsing" mode in Internet Explorer version 8 and Firefox version 3 doesn't delete Flash cookies
• The researchers called Flash cookies a "Persistent Identification Element" (PIE)
• Consumers with a computer running the Windows operating system can view Flash cookie files in this folder: \Documents and Settings\[username]\Application Data\Macromedia\Flash Player
• Consumers with a computer running the Apple operating system can view Flash cookie files in this folder: /users/[username]/Library/Preferences/macromedia/Flash Player/
• The "Clear Private Data" option in the Firefox web browser will not delete Flash cookies
• Some sites use Flash cookies that actively counter the opt-out mechanism from the Network Advertising Iniative (NAI), which enables consumers to opt out of behavioral advertising programs

I am concerned about consumer privacy issues with Flash cookies given the above findings, plus:

The use of Flash cookies is one technology among several used by websites to perform "behavioral advertising" (or "targeted advertising" or "behavioral targeting"). Several Internet Service Providers (ISPs) engaged in behavioral advertising, collected information about their subscribers, and didn't obtain their subscribers consent first. Advertisers and companies in a variety of Industries seem to be rushing headfirst down a similar path with Flash cookies.

When a company collects consumers' data and share it with other companies, the responsible thing to do is to inform its customers (and prospective customers) and then gain their express consent. Today, almost no companies (and government agencies) are disclosing their Flash cookies policies or activities.

Will this situation with Flash cookies improve? I believe that it will take some legal action for change to occur. Awareness among consumers is too low and the pursuit of profits by companies and advertisers is great.

Meanwhile, what can consumers do to protect themselves? Assuming you want to surf the web with as much privacy as possible:

1. Set your web browser to automatically delete HTTP cookies,
2. Firefox web browser users should install the BetterPrivacy add-on to review and delete Flash cookies,
3. Maxa Research offers a software product to help consumers review and delete both HTTP cookies and Flash cookies,
4. Visit the "Flash Privacy and Settings Control Panel" tool at the Adobe website to control what information Flash cookies saves about you, or
5. Surf the web with an iPad or device that doesn't use Adobe Flash.

If you discover any more tools to manage Flash cookies information, please share them in the comments section below.

Survey: 60 Percent of Facebook Members Consider Deleting Their Accounts

First, several bloggers posted animations of the changing privacy situation at Facebook. Second, a Fortune Magazine blog post disputed the backlash notion. I guess that somebody has to be contrary and highlight the opposite position.

Third, there are the findings from a SOPHOS survey of 1,588 Facebook members. When asked via an online poll if they think that they would quit Facebook due to privacy concerns:

• 30% said it is highly likely they would quit
• 30% said they would possibly quit
• 16% said they already quit
• 12% said it's not likely they would quit
• 12% said flat out that they wouldn't quit

Add up those numbers however you choose. 30% would consider themselves likely to quit is not a good statistics for any business. Combine "highly likely" and "possibly" and you arrive at the 60% statistic mentioned in the blog post. Combine "highly likely" and 'already quit" and you get 42% -- no small number to ignore either.

And, it is difficult to effectively set the privacy options on your Facebook account.

Most people I have talked with have no idea how to do it. I guess that is why usage of the Reclaim Privacy site has taken off. The site offers an open-source browser-based mechanism that Facebook members can use to inspect the privacy settings of Facebook account. If you want to learn more, Mashable provides a good review of the Reclaim Privacy site.

I guess that is why Facebook is rushing to develop an easy to use privacy mechanism. If you have tried to effectively modify your Facebook account settings so only you friends can see your personal data, then you know what I am talking about. It's like (sorry for the bad pun) the Wack-a-Mole arcade game. I counted at least four different pages you have to view, and some of them are downright difficult to use. And any privacy settings you change today, Facebook can undo later whenever its executives decide to change the Facebook privacy policy (again).

I fully expect the backlash to continue to grown.

Poll: Readers' Attitudes About Offshore Outsourcing

Over the past few months, I ran an informal poll on this blog asking readers about their attitudes toward offshore outsourcing. While corporations are good at assembling resources and products from various geographic areas to deliver low-priced goods to consumers, a seldom discussed aspect is that corporations also transmit customers' sensitive information between offices and vendors in several countries.

Consumers are well aware of offshore outsourcing when they talk with a customer service representative who clearly has an accent and is located in another country. Many offshore outsourcing activities are hidden from consumers and customers when those activities are performed in back-office or support operations. I explored in a four-part blog series the issues with offshore outsourcing by the major credit reporting agencies. For example, when consumers submit via paper corrections to their credit reports, those corrections are often entered by staff or vendors located in other countries.

With all of this in mind, I asked I've been Mugged readers to select the statement which best describes their attitudes about offshore outsourcing and consumers' credit information. Here are there responses:

• 14% of respondents felt that companies should not perform offshore outsourcing under any circumstances
• An equal number (14%) felt that offshore outsourcing is okay generally, but shouldn't be used for financial and credit information
• The greatest number of respondents (36%) felt that companies should notify customers if they perform offshore outsourcing and customers should have a choice to opt-out
• Far fewer respondents (9%) felt that companies should notify customers if the company's offshore outsourcing includes customers' sensitive data
• 18% of respondents felt that U.S. Congress needs to do more about offshore outsourcing (e.g., legislation for oversight, auditing, data breach notification, etc.)
• 5% felt that credit monitoring services shouldn't perform offshore outsourcing
• 5% don't care whether companies perform offshore outsourcing or not

What to make of these results? First, this was an informal poll. So, it captured the opinions of only I've been Mugged blog readers. Readers of this blog are consumers who have been affected by identity theft, fraud with bank accounts, fraud with their credit reports, and/or data breach victims.

So, the readership of this blog is somewhat of a self-selecting group that has an interest and knowledge about privacy and their sensitive personal information. For the results to be applicable to the entire U.S. population, the survey participants should have included a random selection from the broader U.S. population.

Second, I believe these results are directional in that consumers want to be informed and want control over their sensitive personal information. It was not surprising to me that the greatest number of respondents (36%) felt that companies should both notify customers if they perform offshore outsourcing and provide their customers with an opt-out mechanism.

This indicates that consumers want to be notified and want control over who has access to their sensitive personal information. The company-customer relationship is built on trust. This sensitive customer information It is not for corporate executives to treat as if it is theirs alone.

Like it or not, companies will have to recognize and deal with this reality.