PR Stunts Won't Protect Your Data

I didn't intend to try and put words in your mouth, Terry. Sorry about that.

Government cases are especially concerning, that is very true. Law enforcement breaches could be disastrous--going well beyond financial penalties.

I rather like the idea of the credit agencies having to modify their behaviors after a breach--particularly for those individuals whose credit reports are vulnerable after the disclosure.

Perhaps it is time to put the onerous burden of disclosure on 3rd party firms that store personal information--if I maintain a file on you, I have to tell you. At least then the individuals could know if they are at risk after a breach.

 

Thanks for that personal anecdote, Mike... the stick I have in mind is not credit bureau reporting fees paid by taxpayers indefinitely (or even at all). The case of government agency sloppiness is more troubling than corporate breaches in that apart from firing someone or re-assigning them, there's not much organizational incentive to make sure data isn't exposed. We can't exactly suspend or fine the VA, can we.  

I understand what you're saying, Leland, but this is a tricky one in that Heartland is a clearinghouse for the card-issuing banks. Heartland can't really suspend its clients, nor the reverse, unless banks and their retail clients somehow do multiple sourcing on these transaction approvals. 

But if I understand you correctly, financial institutions that are quick to suspend, assess penalties and interest, or cancel accounts outright ought to be subject to some similar draconian punishment when they drop the ball this way. I'm not holding my breath on this one; the rules will continue to protect those with the power.

Great idea, GajaKannan... not just all the "C" level execs but also all the directors on their board, and at least one family member of each. The prospect of ensuring the company feels the same pain (and spends accordingly to circumvent or minimize the possibility) can only improve the record here.

Actually, a few years ago it was customary in the Far East that the executives of a company whose data had been breached appeared before the board, hanging their heads in acknowledgement of public shame.

I remember a few years ago, the Veteran's Administration has a laptop go missing, with a large file containing my personal information. They responded by paying for me to be added to a credit monitoring service, that is still running today.

My first thoughts about this were how was that data allowed onto a laptop in the first place. Then I thought about the tools that were available to me, and with little effort, I could have some confidential information on my laptop easily enought--with good intentions as part of my market analysis work.

I've recently realized that I am paying for that credit monitoring service still. Not directly, but tax dollars sure are. And I'm a taxpayer, as the politicos keep pointing out to me lately. The problem with financial penalties, or any penalties that upset service, is that someone else usually ends up footing the bill.

Or even worse, things go unreported, and the threats go unnoticed by all of us.

Perhaps shame is good, or a bonding type of solution. Or perhaps an industry that insists that my private information really belongs to them, had better create stronger security alliances that work with law enforcement and do a better job at protecting our data than PCI. A legislative or punitive solution might not drive us the right way, but an industry solution that gives an institution some marketing capital for ongoing work on evolving security solutions proactively (like the bad guys do) might instead work better.

If the carrot doesn't work, there is always the stick. Let's just be sure we are all willing to pay the price.

I agree putting teeth in penalties is the way to go.  Unfortunately blocking their services may penalize those who wish to use them.  Perhaps if there was an automatic dollar credit to all existing customers, that would get the company's attention and would at least offset any concerns other customers might have.

Public scrutiny can be a very compelling antidote.  There should be more public humiliation and perp walking. Soiled reputations and red faces many times do not serve the proper deterant.  In this case the horses already left the barn.

Former CEO of Merril Lynch, John  Thain, publically apologized for his $1.2 office renovation (despite a record $14 billion 4th quater loss) and after Bank of America acquistion of M.L He promised to reimburse B of A.

  He will however be able to keep that $35,000 toilet.

Well, I think stoning, drawing and quartering, or pillorying them would be appropriate. The notion that the consumers have to watch their credit reports after a stunt like this is just bizarre. It seems to me that the credit card issuing banks should be just a little more concerned about security breaches like this.... and if there's any suspending to do, they'd be the ones to do it....

I think a better policy that will have some teeth is that, all the companies that handle someone else data should also put their CXO(CEO, CFO, COO, CIO, etc.,) credit card, their home address, health information, etc., in the same system where they host their customer's information.  If they do, I am sure each IT departments will take all the precautions and measures to ensure the customer data is not compromised...