Weblog
Personal Records Left Unprotected in School District Warehouse
NEW ORLEANS – At 57 years old, Alton Simpson is a watchful eye in his quiet St. Bernard neighborhood.
For more than three decades, he also helped watch over New Orleans public schools as a maintenance worker. That is, up until Hurricane Katrina.
"We weren't laid off, and we never were notified on what happened with us,” Simpson said. “We tried to get answers but they just let everyone go."
Simpson said after he was forced to retire, he assumed his personnel records would be let go too.
"Well, you would think it would all be discarded, shredded," he said.
But his social security number was one of dozens, if not hundreds, that Eyewitness News discovered inside an old New Orleans public school warehouse, a facility seemingly untouched since the storm.
The water line is still clear nearly four years later, and a WWL-TV news crew found the gate leading to the complex unlocked, and the entrance wide open.
Inside were countless boxes filled with confidential information, not to mention stacks of other documents lying on the ground, listing payroll information, worker evaluations, notices of personnel action, and investigations into employee discrimination.
Full names, home addresses, and social security numbers can be seen on document after document.
“Well, it's a little shocking,” said Wade Rathke, the leader of Local 100, Service Employees International Union, the workers union that represents maintenance employees for the Orleans Parish school district.
Eyewitness News showed him video of the warehouse.
"This is a standard story of ‘out of sight, out of mind,’ and to forget your own workers, many of whom may have been there 10, 20, 30 years, and the value of their privacy and the confidentiality of their records, is really sort of unheard of in personnel management,” Rathke said.
Some experts said it could create a very real risk for identity theft, with innocent public-school workers left vulnerable to would-be crooks.
"A lot of times what they'll do is get credit cards in your name, and other lines of credit and could even open a bank account,” said Will Hatcher, an FBI special agent specializing in cyber crime.
At the warehouse, Eyewitness News found no security guards to speak of, or signs to keep people away – just old textbooks and toilets.
It was hard enough to stand, let alone walk, in most parts of the building. The floor was completely covered, with everything from old finger paint to forgotten American flags, and one could actually sense the water damage well before seeing it on the ground.
"We're the owner of the building, so I guess we ultimately have to say, we can only point our fingers at ourselves,” said Stan Smith, chief financial officer for the Orleans Parish school board.
Smith said the school district had no idea the building was unlocked, or that it was still home to confidential documents.
"I'd say that's a lot of bull," said Simpson, the former maintenance worker. After the storm, he says he told lawyers for the school board that personnel files were left inside the building.
School officials say steps were taken soon after Hurricane Katrina to remove what they thought were all of the records, but Smith now acknowledges they clearly were mistaken.
As for the future of the warehouse, the school board says its waiting on FEMA to declare the facility more than 50 percent damaged.
"That would allow us to demolish it,” Smith said.
According to FEMA, $13.7 million have already been obligated for the warehouse. The agency said it approved over $12 million to replace the contents and nearby school buses and nearly $1.5 million to repair the building.
FEMA said the last of the money was approved on April 4, 2008, more than one year ago.
Smith said those millions aren't really available to spend.
"Right now it's paper, it’s sitting on a project worksheet," Smith said.
He said the school district wants to use the money to build more schools, rather than reconstruct a warehouse that's now too big for what the shrunken New Orleans school system currently needs. But that change can't happen until FEMA gives the okay. Even then, the school board will have to shell out the cash first.
"FEMA is a reimbursable program,” Smith said. “You have to spend the money before you get it."
In the meantime, Smith says he also hopes to increase the amount the federal government is willing to give the district for the worn out warehouse.
But progress is slow. In fact, Smith said the process hasn't even started.
"We think it should be able to be done within the next six months,” he said.
FEMA officials denied WWL-TV’s request for an on-camera interview.
What remains certain is that countless confidential records were left unsecured.
“This is going to lead to a number of phone calls and lines of people out at the personnel office for Orleans public schools, to find out what the impact may have been on their records and looking for assurances that they're getting protection,” Rathke said.
Alton Simpson said he'll be one of them.
"I think it's criminal,” he said. “I think it's very foolish of them to handle our documents like that, our numbers, our lives."
The man who helped look after the well-being of New Orleans schools for nearly 32 years, said he's disappointed his employer didn't return the favor.
"I guess you could say everything was washed away with the storm. They just forgot about everybody there and just pushed it aside, didn't care about the employees."
After Eyewitness News notified the school board about the abandoned building, the district hired a moving company to relocate the confidential documents, and another company to shred files. They've been working since last Friday and said they hope to be done by the end of the week.
The doors of the warehouse have also been secured, but the non-confidential materials and garbage inside are not being moved The school board said it is all needed as evidence for when they can get FEMA to reevaluate the damages, in hope of locking in more money to build new schools.
Since Katrina, the Orleans School Board has spent $42.7 million building and renovating schools. FEMA has reimbursed them for about $4 million, but the school board believes they're entitled to at least six times that.
Apartment Dwellers Data Put at Risk by Management
Confidential Paperwork Found In Apartment Dumpster
Posted: April 22, 2009 04:07 PM
Updated: April 28, 2009 09:21 AM
WICHITA, Kan.)
Bank accounts, social security numbers and job history - information needed to rent an apartment. It is information you'd expect to be kept confidential. But we caught one Wichita apartment complex putting its residents at risk.
We got a phone call from a resident at Madison Park Apartments in Wichita. She was concerned because she noticed boxes and boxes of personal information and paperwork inside one of the apartment's dumpsters. She says she called the management to tell them about the problem but when they didn't do anything about it - she called us.
When we got there, we noticed some of the paperwork had fallen outside of the dumpster. It consisted of rental applications which included residents' credit history and information. An apartment staff member came over and we explained what we had found. We showed him a paper that had a Key Management letterhead at the top. Key Management is a company which manages apartment complexes. At first, the staff member denied that paperwork was theirs.
"We're not Key Management," said the staff member. "That's not our company."
He even alludes to the idea someone else may be using the dumpster.
But the next paperwork we dig out has Madison Park Apartments letterhead. It's no doubt from the apartment. We ask the staff member - who refuses to give us his name or job title - about it.
"I don't know how it got thrown away," said the staff member. "It's our policy to shred everything."
In the time we are standing by the dumpster, a number of apartment residents come by and drop off trash. Many of them comment about what they see inside.
"That's not good," said Josh Cafferty. "None of that is good."
When we ask who owns the property, the staff member refuses to tell us. We later track down owner Lew McGinnis from Oklahoma City. We placed two calls to McGinnis to ask him about the situation. Neither of our calls was returned.
As for Key Management, we called and asked them about the situation. It tells us they used to manage Madison Park Apartments a few years ago but no longer do. The company says what we found "concerns us because it reflects on us that we had something to do with it." Key Management says once it stops managing a complex, it obviously has no control over what happens to the paperwork.
Back at Madison Park Apartments, we ask the staff member whether the confidential information will be taken care of. He says it will. After we leave the property, we see workers go through the dumpster and haul away the boxes.
So, what would've happened if someone would've taken some of the private information from the dumpster and used it to steal the person's identity? Could the apartment complex be held liable? We asked the Financial Crimes Division with the Wichita Police Department. They tell us if there's no provable criminal intent, the Kansas ID theft statute does not apply.
Hotel Guests Become Identity Theft Victims
Police: Man Encourages Dumpster-Diving For Credit-Card Info
POSTED: 4:12 pm CDT May 1, 2009
UPDATED: 7:30 pm CDT May 1, 2009
"We had an early flight from the airport, stayed at one of the motels, had dinner," said a local victim who is being called Jane to protect her identity.
Her trip to an airport area hotel almost a year ago ended up causing a headache.
"The entire charges amounted to almost $3,000," Jane said. "It makes me mad."
Jane isn't alone. For more than eight months, police have been trying to determine how thieves accessed more than a dozen different credit card lines.
Investigators discovered the key was hotel Dumpsters and William Frelix, who was allegedly sending people to Dumpster-dive for credit card information.
An individual would call Frelix and say that he or she wanted to buy a certain item from a supply store, for example. Frelix would use these stolen credit card numbers, buy the item and sell it to the person for cash at half price, said Metro Police Capt. David Imhof.
Investigators said they caught Glenn Rankorn with a car motor and transmission purchased with stolen credit and Jasper Howard renovating a north Nashville building into a recording studio.
"We captured $3,000 worth of lumber," said Lt. Mickey Garner.
Police said that most of the victims were not from the area, just passing through on trips, but what happened to them could happen to anyone.
"We have notified the hotels in the area about how they discard that information," said Imhof, who recommends shredding the information.
Police would not reveal the names of the hotels involved.
A warrant for identity theft is out on Frelix, and investigators are working to indict both Rankhorn and Howard.
Personal Documents Found in Dumpster
Updated: Friday, 24 Apr 2009, 7:18 PM EDT
Published : Friday, 24 Apr 2009, 5:30 PM EDT
WILLIAMSBURG, VA - A viewer called WAVY.com and told us someone dumped eight boxes, overflowing with confidential documents, into a dumpster behind a Farm Fresh in Williamsburg.
Inside the boxes were medical records, tax forms, voided checks and copied credit cards.
We spoke with Virginia Jones who is the president of the local ARMA chapter, an organization that deals with records management. She told WAVY.com the documents in the wrong hands, could amount to an identity theft disaster.
"People can get their own credit cards under your name, to get a passport under your name," said Jones.
Our investigation found the thousands of personnel documents belonged to a Virginia trucking company called Warrior Xpress.
The first stop in our effort to figure things out was Farm Fresh management, who gave us this statement:
"We feel it's Warrior's responsibility to take appropriate action with the documents. Farm Fresh does not condone unauthorized use of our dumpsters," said a Farm Fresh management.
After more research, we discovered Warrior Xpress no longer exists. A company called Celadon Trucking bought Warrior Xpress in 2007.
WAVY.com set out to make Celadon aware of what we found and the company answered by saying, "For those who met our hiring criteria, we retained their personnel files. All other driver personnel files, remained the property of Warrior Xpress," Celadon Trucking Inc.
With no one left to take responsibility, WAVY.com took control.
Farm Fresh had the boxes removed from their property and we made a call to our partners at Shred-It, a company specializing in the destruction of personal documents.
The next day, a Shred-It truck arrived, free of charge and the documents were loaded onto the truck to be shredded.
Within just a few minutes, thousands of personal documents were destroyed and multiple cases of potential identity theft were averted.
It's a 10 On Your Side success story, but if you've got personal files you want shredded we can help you too.
Four times a year, 10 On Your Side sponsors a Shred-It event at one location on the Peninsula and another on the Southside.
The next Shred-It event is Saturday May 16. Keep watch here at WAVY.com for an announcement of specific locations closer to that date
FTC delays Red Flags Rule compliance deadline
The Federal Trade Commission will delay enforcement of the new “Red Flags Rule” until August 1, 2009, to give creditors and financial institutions more time to develop and implement written identity theft prevention programs. For entities that have a low risk of identity theft, such as businesses that know their customers personally, the Commission will soon release a template to help them comply with the law. Today’s announcement does not affect other federal agencies’ enforcement of the original November 1, 2008 compliance deadline for institutions subject to their oversight.
“Given the ongoing debate about whether Congress wrote this provision too broadly, delaying enforcement of the Red Flags Rule will allow industries and associations to share guidance with their members, provide low-risk entities an opportunity to use the template in developing their programs, and give Congress time to consider the issue further,” FTC Chairman Jon Leibowitz said.
The Fair and Accurate Credit Transactions Act of 2003 (FACTA) directed financial regulatory agencies, including the FTC, to promulgate rules requiring “creditors” and “financial institutions” with covered accounts to implement programs to identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft. FACTA’s definition of “creditor” applies to any entity that regularly extends or renews credit – or arranges for others to do so – and includes all entities that regularly permit deferred payments for goods or services. Accepting credit cards as a form of payment does not, by itself, make an entity a creditor. Some examples of creditors are finance companies; automobile dealers that provide or arrange financing; mortgage brokers; utility companies; telecommunications companies; non-profit and government entities that defer payment for goods or services; and businesses that provide services and bill later, including many lawyers, doctors, and other professionals. “Financial institutions” include entities that offer accounts that enable consumers to write checks or make payments to third parties through other means, such as other negotiable instruments or telephone transfers.
During outreach efforts last year, the FTC staff learned that some industries and
entities within the agency’s jurisdiction were uncertain about their coverage under the Red Flags Rule. During this time, FTC staff developed and published materials to help explain what types of entities are covered, and how they might develop their identity theft prevention programs. Among these materials were an alert on the Rule’s requirements,www.ftc.gov/bcp/edu/pubs/business/alerts/alt050.shtm, and a Web site with more resources to help covered entities design and implement identity theft prevention programs,www.ftc.gov/redflagsrule. The compliance template will be available on this Web site.
The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 1,500 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s Web site provides free information on a variety of consumer topics.
- MEDIA CONTACT:
- FTC Office of Public Affairs
202-326-2180
Computer hard drive sold on eBay 'had details of top secret U.S. missile defence system'
Last updated at 11:08 AM on 07th May 2009
Highly sensitive details of a US military missile air defence system were found on a second-hand hard drive bought on eBay.
The test launch procedures were found on a hard disk for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system, used to shoot down Scud missiles in Iraq.
The disk also contained security policies, blueprints of facilities and personal information on employees including social security numbers, belonging to technology company Lockheed Martin - who designed and built the system.
A missile launch in California: Details of the ground-to-air defence system were found on a computer hard drive
British researchers found the data while studying more than 300 hard disks bought at computer auctions, computer fairs and eBay.
The experts also uncovered other sensitive information including bank account details, medical records, confidential business plans, financial company data, personal id numbers, and job descriptions.
The drives were bought from the UK, America, Germany, France and Australia by BT's Security Research Centre in collaboration with the University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US.
A spokesman for BT said they found 34 per cent of the hard disks scrutinised contained 'information of either personal data that could be identified to an individual or commercial data identifying a company or organisation.'
And researchers said a 'surprisingly large range and quantity of information that could have a potentially commercially damaging impact or pose a threat to the identity and privacy of the individuals involved was recovered as a result of the survey.'
Two disks appear to have been formerly used by Lanarkshire NHS Trust to hold information from the Monklands and Hairmyres hospitals including patient medical records, images of x-rays, medical staff shifts and sensitive and confidential staff letters.
In Australia, one disk came from a nursing home and contained pictures of patients and their wounds.
Confidential material including network data and security logs from the German Embassy in Paris were also discovered on a disk from France.
And the trading performances and budgets of a UK-based fashion company, corporate data from a major motor manufacturing company were discovered along with details of a proposed 50 billion currency exchange through Spain involving a US-based consultant.
Dr Andy Jones, head of information security research at BT, who led the survey, said: 'This is the fourth time we have carried out this research and it is clear that a majority of organisations and private individuals still have no idea about the potential volume and type of information that is stored on computer hard disks.
'For a very large proportion of the disks we looked at we found enough information to expose both individuals and companies to a range of potential crimes such as fraud, blackmail and identity theft.
'Businesses also need to be aware that they could also be acting illegally by not disposing of this kind of data properly.'
Dr Iain Sutherland of the University of Glamorgan said: 'Of significant concern is the number of large organisations that are still not disposing of confidential information in a secure manner. In the current financial climate they risk losing highly valuable propriety data.'
A spokesman for Lockheed Martin, who make the THADD launch system, said: 'Lockheed Martin is not aware of any compromise of data related to the Terminal High Altitude Area Defence programme.
'Until Lockheed Martin can evaluate the hard drive in question, it is not possible to comment further on its potential contents or source.'
A spokesman for NHS Lanarkshire said: 'This study refers to hard disks which were disposed of in 2006. At that time NHS Lanarkshire had a contractual agreement with an external company for the disposal of computer equipment.
'In this instance the hard drives had been subjected to a basic level of data removal by the company and had then been disposed of inappropriately. This was clearly in breach of contract and was wholly unacceptable.'
The spokesman said the trust now destroy equipment containing data on the premises, so no longer use external companies to dispose of IT equipment.
IRS Audits of Small Companies Rising
ARMA International Information Management Newswire, June 2008
According to Fortune Small Business and other sources, the IRS has increased its audits of small companies. The rise in tax audits has implications for records management in small firms because records that document tax deductions often come under scrutiny during audits and must be held from destruction while an audit is in progress. Inability to destroy records on hold can add to costs for records storage and maintenance.
A study by the Transactional Records Access Clearinghouse (TRAC) at Syracuse University showed that small companies were audited 41 percent more often in 2007 than in 2005. TRAC's report also noted that companies with $10 million to $50 million in assets were 29 percent more likely to be audited. In contrast, major corporations – those with assets of $250 million or more – had only a one-in-four chance of being audited in 2007 compared with a three-in-four chance in 1990.
The IRS believes that small businesses are a big reason for the tax gap, which is the difference between the amount of taxes paid and what the government is actually owed. But the TRAC study shows that, on average, large company audits turn up about $7,500 per hour in additional taxes owed compared with $474 per audit hour in small firms.
Reasons given for the focus on small businesses vary. A spokesperson for the National Treasury Employees union told of reports from IRS employees who said they were under pressure to increase productivity by limiting the scope of audits. The theory is that, under such pressure, auditors will pursue smaller, easier audit targets. The IRS has responded that it is actually focusing on the use of partnerships and other entities that companies of all sizes use to minimize taxes. A deputy IRS commissioner told The New York Times that the IRS is focusing on private partnerships that some large corporations use to avoid paying taxes.
The Kiplinger Business Resource Center notes the areas most likely to be examined during IRS audits of small businesses are:
* Worker classification – documentation that distinguishes independent contractors from employees
* Retirement plans – particularly documentations showing mistakes made in administering simplified employee pensions plans
* Tip reporting – forms used by restaurants and other service businesses that require them to allocate tips according to a percentage of sales
Small business owners who believe that they are "under the radar" for tax audits because of their size should take heed. One small business owner estimates that he spent $50,000 on the tax audit process that lasted 18 months. Ironically, the IRS has instituted a CAP program for large corporations that results in tax audits closing within six months of filing returns, allowing major savings for records whose retention is designated as "close of tax audit."
Secret Papers Left on Commuter Train- Twice
ARMA International Information Management Newswire, June 2008
Several London newspapers recently reported that classified intelligence documents were found on commuter trains in two separate incidents within the same week. The mishaps are a reminder that records security – regardless of whether records are paper or electronic – relies on human attentiveness to be effective.
On June 12, The Times of London reported that a senior intelligence official left a set of papers marked "top secret" on a train from Waterloo station to Surrey. One of the documents is believed to be a report commissioned by the Foreign Office titled "Al Qaeda: Constraints and Vulnerabilities." The report's seven pages are each headed "for U.K., U.S., Canadian, and Australian eyes only." A second document, "Iraqi Security Forces: More or Less Challenged?" was a British assessment of Iraqi police. Both documents were in an orange envelope found by a fellow passenger and given to the BBC.
A cabinet office spokesman quoted in The Guardian said police would investigate the security breach. Scotland Yard said its counter-intelligence unit would be in charge of the inquiry. Reports said a police investigation rather than an MI5 inquiry suggests that the documents were believed simply lost or mislaid and not the target of enemy intelligence agents.
The senior official believed responsible for the lapse had permission to remove the documents from the office providing that adequate security measures were taken, which often means a locked box. It was not clear whether such precautions were taken. The official has been suspended.
One day later, another set of confidential documents was discovered on a train again heading for Waterloo station. This time, topics included the British government's computer systems' weaknesses in tracking financial fraud and details of how international finance systems could be manipulated to finance terrorist weapons. Also found were sensitive notes and draft speeches for a financial crime conference scheduled to take place in London.
The breaches occurred just as the prime minister was seeking Parliament's approval for greater security powers and enhanced counter-terrorism measures. Senior members of Parliament have accused the government of a culture of carelessness. Said one in the Daily Mail, "It is astonishing how easy it is for these files to be left in public places. Our enemies don't even need to hack our computers; they apparently just need to travel on public transport." Others have suggested that officials, regardless of seniority, not be allowed to take classified or confidential documents outside their offices for any reason until all inquiries have been concluded.
Indiana Attorney General Launches ID Theft Unit
SDB News 6/9/2008 3:18:43 PM
Indiana Attorney General Steve Carter has created an Identity Theft Unit to help ID theft victims and to provide additional resources to local law enforcement investigating and prosecuting such crimes.
"Our new unit is designed to reduce the frustration felt by victims and to provide expertise and resources to local law enforcement authorities in investigating and prosecuting this crime," Carter says. "We work with entities regularly on compliance with Indiana’s security breach notification law."
The ID Theft Unit is a part of the Consumer Protection Division of the Attorney General’s Office and is staffed by a team of attorneys, investigators and support staff.
The unit actively investigates alleged fraud and provides hands-on assistance to consumers to help them address and correct the problems caused by the identity theft. The unit offers assistance, expertise and resources to local law enforcement and prosecutors in criminal prosecution efforts that may result.
The ID Theft Unit also advocates educational efforts with the assistance of J. Michelle Sybesma, an identity theft survivor and creator of www.GetIDSmart.com, a Web site designed to educate the public on protecting personal information from thieves.
Indiana’s Security Breach Notification Law took effect July 1, 2006, and requires companies and individuals who hold personal information in an electronic format to notify those people affected if the data has been left unsecured and available for unauthorized access. More than 23 private sector breaches have been reported to the attorney general’s office since the law took effect.
An Identity Theft Victim Kit, tips for protecting against ID theft, instructions for placing a security freeze and information on how to file a complaint with the ID Theft Unit can be found at www.IndianaConsumer.com.
Bonnevile Bank of Provo Receives 5-Star Rating
by PR or Business News Wire
Bauer Financial Inc., an independent bank rating and research firm, announced that Bonneville Bank of Provo has earned another five-star superior rating, which marks the 53rd consecutive quarter the bank has achieved such honors.
"We have been awarded the five-star rating for over ten years," said Doug Christensen, president of Bonneville Bank. "Because only 15 percent of the banks in the United States have received this achievement, they have [also] named us an Exceptional Performance Bank."
The rating recognizes banks based on an evaluation of the most recent financial data filed by the bank with federal regulators.
"The five-star rating is based on the overall financial picture of the bank and indicates that Bonneville Bank is one of the strongest banks in the nation," Karen L. Dorway, president of Bauer Financial in Coral Gables, Florida, said. "Times are changing and fewer banks are qualifying for this top rating."
In addition, Bonneville Bank also recently celebrated its 30th anniversary, opening in 1978. It is located at 1675 N. 200 West in Provo.
Drill Now, Drill Here, Pay Less
By Bill Steigerwald
Pittsburgh TRIBUNE-REVIEW
Sunday, June 15, 2008
Something else to think about next time you're feeding your Ford Mini-brontosaurus $80 worth of regular gasoline:
According to the federal Minerals Management Service, about 86 billion barrels of oil and 420 trillion cubic feet of natural gas are locked up and untouchable just off our shores.
"Locked up"? By whom? Who could be so stupid? So diabolical? So un-American?
Big Oil? The U.N? Those evil Exxon Republicans who took us to war for oil in Iraq?
Close. It's our cracked-up Congress -- mainly liberal Democrats who are beholden beyond reason to the religious left's most dangerous fundamentalist sect, wacko environmentalism.
For 27 years Democrats and Republicans have used a two-sentence rider in annual Interior Department appropriations bills to outlaw development of the vast oil and gas fields that we know exist within 200 miles of our coasts.
But Rep. John Peterson, a Republican from upstate Pennsylvania whose crusade to fix America's broken energy policy has brought him the interplanetary enmity of environmentalists, has made it his mission to slay that foolish rider.
All Peterson wants to do is get Congress to allow America to do what every other sensible modern country on Earth from Norway to New Zealand has been doing for decades -- open our deep-sea energy reserves to safe, environmentally sensitive development.
Peterson's latest attempt to kill the foolish rider was Wednesday at a subcommittee hearing when he offered an amendment to the Interior Department appropriations bill that would allow oil and gas drilling rigs to operate between 50 and 200 miles offshore -- so that no liberal's tender eyes can ever see them.
Given $140-a-barrel oil, Peterson thought he could win over two Democrats. But the final tally was 9-6 against him on straight party lines, Peterson said after the vote Wednesday from his office in Washington.
Despite his setback, Peterson remains an unabashed cheerleader of the increasingly popular "Drill Now, Drill Here, Pay Less" movement.
Most Democrats cling to shortsighted, economically fallacious arguments against offshore drilling, but Peterson says Canada is solidly on his side.
Canada, which he said thinks we are "crazy for locking up all our good stuff," is mad at us for not tapping our vast natural gas supplies. By not producing enough of our own natural gas, we drive up the North American price.
In fact, he said, for the last eight years the United States has paid the highest price in the world for natural gas -- about $12.50 per million Btu. Canada pays the second-highest price. South America, by the way, pays about $1.50.
Peterson will try again this week to lift the congressional moratorium on offshore drilling when the full 66-member House appropriations committee meets. All he needs is a majority of one -- and since his similar effort last year lost by only eight votes, he has hope.
"Americans are upset. If we can have a public discussion, if the press does its job -- not picking sides, just putting the facts our there -- and if we just have a factual debate, we will produce more energy.
"The American public is approaching 60 percent now in favor of drilling. If they understood this issue, they'd be 80 or 90 percent for drilling."
Only the enviro-radicals would still be opposed, he said. "And they don't want coal and gas. They don't want oil. They don't want nuclear -- and some don't want wind offshore if it's near their home."
Bill Steigerwald is the Tribune-Review's associate editor. He can be reached at bsteigerwald@tribweb.com or 412-320-7983.
Quotes
"11% of respondents reported sabotage of data or networks...80% of respondents feared likely sources of attack from disgruntled employees." CSI 1999 Computer Crime and Security Survey
"Two thirds of records in organizations without records management may be reomoved from offices and either destroyed as being obsolete or transfered to lower cost offsite facilities." Information and Records Management, 4th Ed, Robek, Brown and Stephens
"Computer users spend 7.5% of ther time on a PC looking for misplaced files." (Survey reported in Information Week).
"For every dollar spent to store records in these off-site [records management] facilities, it is estimated the government saves four dollars."Sandy Santori, Director of the Ministry of Management Services for the Providence of British Columbia, Canada (Brackets added for clarity)
"It is estimated that the dollar cost of maintaining 8 cubic feet of records (the content of a 5-drawer letter size vertical filing cabinet) in an average state office for one year is more than $2,100 per year." Oregon State University
*”At any given tome, between 3% and 5% of an organization’s files are lost or misplaced. The average cost of recreating a document is $180”(Information Week)
*”The annual cost of storing one cubic foot of records in a records center is $21.50 less than that same cubic foot maintained in typical office space and equipment” (National Archives and Records Administration)
*”As much as 70% of all indentity theft starts with the theft of personal data from a company by an employee” (CPA Journal) Records Management Handbook
Four Tips for Crafting a Document Retention Policy
Computerworld/IDG News Service - Oslo,Norway - May 23, 2008
The 2002 Sarbanes-Oxley regulations served as a wake-up call for CIOs to formalize document retention policies to meet compliance requirements. But regulatory demands-and the number of documents produced daily-continue to grow. So a solid document management process is a necessity. CIOs struggle with creating the policies, getting buy-in from the end users and managing the technology. Members of the CIO Executive Council, who meet regularly to discuss compliance approaches, share techniques that have made document retention policies work for them.
The 2002 Sarbanes-Oxley regulations served as a wake-up call for CIOs to formalize document retention policies to meet compliance requirements. But regulatory demands-and the number of documents produced daily-continue to grow. So a solid document management process is a necessity. CIOs struggle with creating the policies, getting buy-in from the end users and managing the technology. Members of the CIO Executive Council, who meet regularly to discuss compliance approaches, share techniques that have made document retention policies work for them.
Get the policy right
The first step is making sure that the right items are covered in your document management policies. For this, CIOs can rely on business peers, outside counsel and special regulatory tool kits.
"Initiating a high-level review of our document retention policies had to be a joint effort between myself and the general counsel. If we weren't both involved, I don't know how the effort could succeed," says George Washington University CIO Ron Bonig. For instance, GWU receives subpoenas and e-discovery requests around contracting and personnel questions. To ensure colleagues' participation and buy-in, Bonig stresses the fiscal importance of good policies and compliance. "The cost to the university in a federal lawsuit could be huge if we don't properly address retention," he says. "I put it in dollars, which really woke people up."
Strict HIPAA regulations govern patient medical information security in healthcare organizations. To create policies consistent with those rules, Michael Gaskin, director of information services at Sequoia Community Health Centers, purchased a HIPAA security toolkit. "The toolkit made it easy for me to review documents and know what I must include in my plan, " says Gaskin. The kit's workflow examples continue to inform Gaskin about compliance needs and how to refine his document retention policies.
Balance stakeholder interests
For ArcelorMittal Americas CIO Leon Schumacher, the challenge is making sure the interests of different stakeholders-users, legal, IT-are considered when developing a retention policy. "Each has specific issues that they want to address. Good communication before and during such definition phases is critical for success," he says.
The delicate balance between users' storage needs and retention guidelines is hard to strike. For example, Schumacher's team created management policies for personal storage limits, including how much e-mail people can maintain. But the team heard complaints that users weren't getting enough space. Schumacher responded by introducing policies at two levels: one for management, which gets 500MB of storage, and one for general users, which get 250MB. The team is working on newer archiving solutions to further ease these constraints.
Plan for the long term
Policies must cover document retention over a long period. For a university, this is a huge issue given the length of time it must keep student loan data, transcripts and other federally mandated data. "One of the issues is to make sure that the documents in their electronic form can be upgraded and transitioned from one technology to the next over decades," says GWU's Bonig. So his team watches the storage landscape to stay abreast of any technology that would necessitate a business decision about whether to transfer retained documents.
Make it pay
A good document retention policy can do more than avoid legal fines. At American Greetings Interactive, Senior VP and CTO Rajiv Jain has policies to archive everything on the desktop and retain all executive e-mails indefinitely. "Our e-mail retention policy has definitely come in handy. There was a disagreement over the fees associated with vendor negotiation. We were able to find the original archived e-mail from the vendor, which proved that we were right and did not owe the amount of money they claimed," says Jain.
The effort to build and enforce good document polices can provide a strategic advantage.
Most of GWU's back-office staff work at its Virginia campus 30 miles away. Only representatives for financial aid, undergrad admissions and other student offices sit in the D.C.-based Student Union. If a student has a difficult question, the rep may consult a staff expert in Virginia. Now they can look at the same document simultaneously, since Bonig and his team are digitizing documents for retention. "We improved our business process dramatically and can confidently say that we offer student services from anywhere," says Bonig.
Sidebar: Tips for crafting a policy that works offered by Ron Bonig of George Washington University, and Rajiv Jain of American Greetings Interactive
Properly define "document" to include information of all types-electronic or paper, historical or transient business record.
Clearly state who and what function is the relevant retention authority for the most widely used categories of documents.
Indicate the specific duration of retaining different types of documents.
Identify specific staff or functions that have appropriate read, write and edit access.
Clearly state the reasons that retention is necessary (e.g. Sarbanes-Oxley rules, HIPAA regulations). As those requirements change, the rationale for retention should be reviewed, and any changes to the retention period should be made.
State that if a file or folder contains multiple types of documents necessary for a coherent record, then the whole file or folder must be retained for the duration of the longest-held item.
Except when absolutely necessary, do not allow (or at least strongly discourage) the mixing of digital documents in storage. If document A needs to be retained for five years and document B needs to be retained for 20 years, keep them separate. You will reduce the cost of long-term storage and will avoid legal risks inherent in a failure to follow retention policies.
Give individual divisions or offices the authority to set retention policies for their own operational documents if approved by or coordinated with the General Counsel or Compliance Office.
-C.M.
Product Destruction
Destruction by Design
By Brian Taylor
btaylor@gie.net
6/3/2008 4:04:43 PM
Secure destruction companies have become involved in product destruction in several ways. In some cases, owning shredders makes them ideal service providers for customers with excess merchandise to be destroyed and kept from entering unauthorized sales channels.
Information destruction companies that provide electronic data destruction services also serve corporations with off-lease and returned merchandise in large volumes.
In both cases, these services may merge with mandated recycling systems that have been enacted in several states and that are advocated by groups like the Product Stewardship Institute Inc. (PSI), based in Boston. The group is hosting a conference June 3-5 in Boston, with one of the topics being the recycling of electronics.
Scott Cassel started PSI in December of 2000. According to its Web site, "PSI works with state and local government agencies to partner with manufacturers, retailers, environmental groups, federal agencies and other key stakeholders to reduce the health and environmental impacts of consumer products." The organization’s work can include encouraging product design changes to facilitate recycling and mediating dialogues among various stakeholders.
"What we have created is a forum for the research and negotiation of new systems for managing and financing the sustainable way to manage products," Cassel says of PSI.
If computers and other data-bearing products continue to enter mandatory recycling systems, how should information destruction companies ensure that their critical role remains part of such systems?
Secure Destruction Business magazine Editor-in-Chief Brian Taylor asked PSI Executive Director and CEO Scott Cassel that question as well as several others during a recent interview.
SDB: How does your organization define product stewardship?
Scott Cassel: Product stewardship is a principle that directs all those involved in the life cycle of a product to take shared responsibility for reducing the health and environmental impacts that result from the production, use and end-of-life management of the product.
Everybody has a role, including government and consumers; but, manufacturers and retailers have the biggest opportunities to influence product stewardship.
SDB: Why is product stewardship the right way to handle obsolete electronics?
SC: It’s the way to manage all products because it helps drive design changes. It addresses the need for sustainable funding. It brings all parties together to negotiate a solution where responsibility is shared, with particular responsibilities being assigned to manufacturers and retailers. Manufacturers are the ones that have the greatest opportunity, in part by designing products so they have less of an impact on the environment. Retailers are in direct contact with consumers, so they can play a key role in that way.
Electronics are the first products on which this perspective has been focused here in the U.S. Producer responsibility systems started with packaging in Europe, and with WEEE (the Waste Electrical and Electronic Equipment Directive) they addressed electronics.
Here in the United States, electronics were the most important from a waste management perspective.
SDB: Have manufacturers responded to these concerns?
SC: Absolutely, in a big way manufacturers have responded. In electronics, during the national dialog NEPSI (National Electronic Product Stewardship Initiative), which was overseen by the EPA (Environmental Protection Agency), I saw a distinct change in the perspective of the electronics manufacturers.
Originally they wanted the government to increase the funding of their programs. Little by little they moved to end-of-life fees, and then a monumental shift occurred to internalize the end-of-life cost into the product costs.
That effort started with the ARF (advanced recovery fee) system in California and now includes producer responsibility.
Thermostat and rechargeable battery makers have producer responsibility systems, though a little weak.
Our organization is working with many others to bring about a fundamental shift in how waste is managed. What I’m seeing is a change not only in companies, but entire industries, and that takes time.
SDB: Are there any manufacturers that can be singled out?
SC: A number of the electronics manufacturers should be credited with the shift that has taken place over the past eight years. Originally, it was Panasonic, Sharp, Sony and Philips that got some progress started by agreeing that the purchase price of a product should reflect the end-of-life management costs. But they all originally supported an ARF system. While ARFs were used for used motor oil and tires several decades ago as a financing mechanism, current systems in the United States have moved away from ARFs.
HP, Dell and now Sony have moved toward individual producer responsibility systems. That has moved the ball more toward producer responsibility. These programs are more in line with systems that are taking hold in the United States now.
Still, it’s not a unified approach that yet works for the citizens with all companies. That’s the missing element right now. Even with these individual producer responsibility systems, it has not been worked out how they necessarily work together.
All this is moving in the right direction, but there is still more work to be done.
SDB: To what extent have data security and privacy concerns been factored into electronics product stewardship proposals?SC: Obviously, that is an issue, because companies are very concerned about data security. I think it affects the re-use end in particular. That is the preferable environmental use, but there are considerations when it comes to data security. They are not necessarily at odds with each other, but it can require extra attention. We want to find some way where re-use can be maximized but data security is present.
SDB: To what extent does your organization prefer voluntary stewardship vs. legislatively mandated stewardship?
SC: Voluntary systems don’t work. There are very few instances where voluntary systems have proven to be effective in a comprehensive manner. They can create some momentum. However it’s unfair to company leaders to spend the money and allocate resources to address a problem of design and end-of-life management without a level playing field.
There needs to be a level playing field for all companies in the pursuit of environmental goals. And there needs to be a penalty for bad actors. The only way to ensure that is through negotiated, consensus-based legislation. And that’s PSI’s approach.
The legislation would need to work for all players. It will ensure their commitment to implementing solutions. And it will ensure a better solution by having all parties included.
SDB: Is the escalating cost of raw materials changing the way manufacturers view the value of end-of-life products?
SC: Absolutely. I’ve heard people talk about current markets as moving into the secondary materials age. There is a great demand for secondary materials, particularly in China, where they are importing secondary materials from the United States.
And as it becomes more expensive to extract primary materials from the environment, there is a greater demand to recover materials from products. That is impacting product stewardship. Part of that is not only design changes up front, but collection at the back end. If there is more value, there is more interest in maximizing the collection of those materials.
SDB: Do you have any concern that adding electronic scrap to the Universal Waste Rule would have unintended negative consequences for data security and recyclingefforts?
SC: Bringing in electronics under Universal Waste would be a plus, because you would get greater environmental protection with reduced administrative costs. As long as the states have control over the management of material, which they would with the Universal Waste Rule, we can make it easier to transport and recycle material and at the same time reduce management costs. I think that’s a very good thing.
SDB: How do retailers and existing data security and recycling firms fit into the product stewardship scenarios that you envision for electronics?
SC: For the data security firms, I think they would give assurance to companies that collect equipment that it is managed in a way that does not compromise proprietary data; that’s important. It might lead to some knee-jerk reactions to recycle rather than re-use, but that needs to be resolved through
communication.
SDB: What would electronics recyclers and data destruction professionals learn by attending your June event in Boston?
SC: The conference is set up to address broad issues, such as performance goals, financial incentives and the retailer’s role in product stewardship, across many products. There is a session on the electronics regulations in the U.S.
We attract the top government and industry professionals working on product stewardship in the United States. All of these officials are working on electronics, so there will be networking opportunities to talk to those people who are working on electronics issues in their states. We’ll probably get representatives from more than 20 states at our conference. n
Scott Cassel is the executive director of the Boston-based Product Stewardship Institute and can be contacted atscott@productstewardship.us.
Compliance Toolkit Press Release
For Immediate Release
UTAH VALLEY RECORDS MANAGEMENT REPRESENTATIVE BECOMES AUTHORIZED COMPLIANCE TOOLKIT PROVIDER
June 11 2008
Orem, Utah – Utah Valley Records Management is proud to announce that Kent L Curtis is one of a limited number of information security professionals nationwide to be authorized as a distributor for a new Information Destruction Policy Compliance Toolkit. The “Toolkit,” available free-of charge, is designed to help organizations develop the written information destruction procedures now required by law. According to the National Association for Information Destruction (NAID), most organizations in the US report that they currently do not comply with this requirement and, therefore, are at risk. The Toolkit is the first and only publication to specifically address information destruction policy development with a goal of making compliance with the laws easy and understandable.
And, the timing could not be better.
The Federal Trade Commission recently reached a settlement with an Illinois-based mortgage company for discarding personal information without first destroying it, resulting in a fine of $50,000. In the settlement, the FTC cited the absence of the required written policies and procedures as a basis for the penalty. Similarly, the Attorney General of Texas recently announced two settlements with retailers for improper disposal of personal information, also citing the failure to have written policies and procedures. In each of the settlements, the resulting fines amounted to hundreds of thousands of dollars.
According to NAID’s executive director Robert Johnson, “It is obvious that law enforcement agencies are becoming more aggressive in requiring compliance with the information destruction regulations as they continue to struggle with the growing ID Theft epidemic. Since last summer alone, there have been more fines, charges and penalties for improper disposal of personal information than there have been in the prior 10 years.”
“For some organizations, the policy on information destruction amounts to a single sentence, advising employees to destroy sensitive information properly before it is discarded,” Johnson adds. “In today’s social and business climate, that simply does not provide sufficient direction to employees who are dealing with many forms of media from any number of sources. Regulators, auditors, courts of law, the media and public sentiment are insisting on a more thorough approach to information disposal because of the potentially devastating consequences of improper disposal on people’s lives.”
Prior to authorizing a NAID Member representative to distribute the Toolkit, NAID requires that they become oriented in its use. Only individuals who have completed the orientation are permitted to distribute it.
The Toolkit contains sample policies and procedures for training, authorization and destruction for the full range of conventional media forms, including paper records, computers, magnetic tapes, optical and micro media. In addition, the Toolkit includes sample forms, templates and other resources useful in implementing the policy. And, while the Toolkit offers information destruction procedures for in-house information destruction, it also contains sample policies and procedures for selecting competent service providers.
Alan Andolsen, a highly regarded records management consultant who contributed to the Toolkit, says, “To my knowledge, this is the most thorough examination of proper information destruction available to date. It is something that can be integrated into almost any existing information management or security program or it can stand on its own.”
The NAID Information Destruction Policy Compliance Toolkit, which runs over 70 pages and includes a CD, containing electronic versions of all templates and sample forms, is available free-of-charge.
For more information on the NAID Information Destruction Policy Compliance Toolkit, contact Kent L Curtis at Utah Valley Records Management by telephone at 801-225-8876 or by email at kent@utahvalleyrecords.com.
About Utah Valley Records Management
Utah Valley Records Management (UVRM) is Utah County's first local company specializing in records management and storage, records scanning, digital media storage, and secure document destruction. UVRM was voted by Utah Valley BusinessQ Magazine as one of 2008's top ten start-up’s to watch and plans to quickly grow into Utah County business’s top choice for the care and destruction of sensitive documents. UVRM is dedicated to helping you keep your records up to date, organized and in compliance with current laws and regulations.
Utah Valley Records Management offers a secure off-site shredding service for all of Utah Valley, and can shred individual files or entire boxes. All of UVRM's shredding is done securely and professionally. UVRM provides a certificate of destruction if needed. The high capacity shredder at UVRM's secure facility enables them to shred at a lower cost than is possible with a mobile on-site shredder. Those savings get passed on to their customers without compromising document security.
For more information please contact:
Kent L Curtis
Utah Valley Records Management
1042 S Geneva Road
Orem Ut 84058
801-225-8876
BBB Heralds Success of Secure Your ID Day
Due to the overwhelming success of the Better Business Bureau’s Secure Your ID Day event, held May 3, the BBB will be holding an additional "Protect Your ID" shredding and education event Sept. 20, 2008.
The first event, held in 54 cities throughout the nation, resulted in 250 tons of documents delivered to BBB shredding sites where they were safely shredded.
BBB and its national partners, Equifax and NAID are committed to providing identity protection solutions and products to patrons to help them safeguard their identities – online and offline.
ID theft is a serious problem claiming eight million victims last year, alone," said Steve Cole, president and CEO for the Council of Better Business Bureaus. "BBB nationally partnered with identity theft protection champion, Equifax, and the National Association of Information Destruction to enable people across North America to close a loophole against ID thieves."
(Source: Secure Business Destruction 6/4/08)
ID Theft Couple's Plea Deal
'Bonnie and Clyde' Jet-Setters Sign Plea Deal in Massive ID Theft Case Monday, May 12, 2008
An undated photo of Edward Anderton, 25, and Jocelyn Kirsch, 22, a Philadelphia couple accused of financing a jet-setting lifestyle through an elaborate identity theft scheme.
A young couple accused of stealing the identities of more than 16 people to live expensively and travel the world in style have agreed to plead guilty to federal charges, an attorney said Monday.
Jocelyn Kirsch, 22, will plead guilty to six counts, including two counts of aggravated identity theft, one count of bank fraud and one count of money laundering, the lawyer, Ronald Greenblatt, told The Associated Press.
"She's supposed to be graduating college now, and instead she's going to be going down to federal court in a few weeks and entering a plea," Greenblatt said.
Kirsch, who left Drexel University inPhiladelphia after being charged, faces a mandatory minimum of two years in prison, with a potential of more than five years.
Her boyfriend Edward Anderton, 25, also signed a federal plea deal, Greenblatt said, but did not give details. Messages left for Anderton's attorney, Larry Krasner, were not immediately returned.
A federal information released Monday charges the couple with conspiracy, aggravated ID theft, access device fraud, bank fraud and money laundering. An information usually indicates the defendant's willingness to plead guilty.
Authorities allege the couple victimized at least 16 people — including friends, co-workers, neighbors, fellow students, bar patrons and others — by stealing their identities and credit card information for a year beginning in November 2006.
In all, Kirsch and Anderton obtained nearly $120,000 in cash and merchandise, authorities said, adding the couple unsuccessfully tried to obtain $112,000 more.
"These defendants helped themselves to the financial viability of their friends and co-workers, reinventing ways in which to victimize those who had trusted them, for little more than their own entertainment," U.S. Attorney Patrick Meehan said Monday.
Anderton even stole personal data from someone who provided it as part of a job application at the real estate equity firm where he worked, authorities allege.
Police said the fraud enabled the couple to finance their $3,000-a-month Rittenhouse Square apartment and luxury trips to Paris, London and Hawaii.
City police released copies of the couple's vacation photos after their arrest in December. Detectives also showed off a table full of fake ID cards and driver's licenses they had seized, along with computers, printers, a machine that makes ID cards, $17,000 in cash and several neighbors' keys.
The vacation photos show the couple swimming in the Caribbean, dining at upscale resorts and kissing under the Eiffel Tower. Kirsch is often seen posing in bright bikinis and slinky outfits.
The two stole the identity of neighbors in their building and at least twice broke into other units, police said. The police search also turned up a book called "The Art of Cheating: A Nasty Little Book for Tricky Little Schemers and Their Hapless Victims."
Anderton, who has returned to his hometown of Everett, Wash., graduated in 2005 from the University of Pennsylvania with an economics degree. Kirsch, the daughter of a North Carolinaplastic surgeon, now lives in Novato, Calif.
Police started investigating after a neighbor was told she had a package waiting from a British retailer — an order she had never placed. Suspecting identity theft, she called police, who staked out the UPS store and caught Anderton and Kirsch.
The two were subjected to a frenzy of local media attention, largely because of the provocative photos.
The couple were originally charged in state court. A judge dismissed the state charges Monday at the request of prosecutors.
Jocelyn & Eddie: “Poster children for ID theft”
By Joseph A. Gambardello
INQUIRER STAFF WRITER
A former Center City couple were charged today by federal authorities with stealing the identities of at least 16 people and using them to illegally gain at least $119,000 in cash and merchandise.
They also tried to scam another $112,000 but failed, officials said.
U.S. Attorney Pat Meehan today called Jocelyn Kirsch and Edward Anderton "the poster children for identity theft." He said their victims included not just strangers but also co-workers, neighbors and friends.
State charges against the two were dropped today in favor of the federal prosecution.
Meehan, describing an elaborate, year-scheme during which the pair allegedly donned disguises to withdraw money from bank accounts they created in others' names, said prosecutors will aim to insure Kirsch and Anderton receive 5-year prison terms.
He declined comment on a report that Kirsch at least would plead guilty under an agreement with prosecutors.
Her attorney Ronald Greenblatt told the Associated Press his client will plead guilty to six counts, including two counts of aggravated identity theft, one count of bank fraud and one count of money laundering.
"She's supposed to be graduating college now, and instead she's going to be going down to federal court in a few weeks and entering a plea," Greenblatt said today.
"Their year of living dangerously has caught up with them now," said U.S. Attorney Meehan.
Kirsch, 22, who left Drexel University in Philadelphia after being charged, faces a mandatory minimum of two years in prison, with a potential of more than five years.
Her boyfriend Edward Anderton, 25, also signed a federal plea deal, Greenblatt told the AP, but did not give details. His attorney, Larry Krasner said this morning he would have no comment.
Authorities allege the couple victimized at least 16 people - including friends, co-workers, neighbors, fellow students, bar patrons and others - by stealing their identities and credit card information for a year beginning in November 2006.
"These defendants helped themselves to the financial viability of their friends and co-workers, reinventing ways in which to victimize those who had trusted them, for little more than their own entertainment," Meehan said today.
Anderton stole personal data from someone who provided it as part of a job application at the real estate equity firm where he worked, authorities allege.
Police said the fraud enabled the couple to finance their $3,000-a-month Rittenhouse Square apartment and luxury trips to Paris, London and Hawaii.
City police released copies of the couple's vacation photos after their arrest in December. At that time detectives also showed off a table full of fake ID cards and driver's licenses they had seized, along with computers, printers, a machine that makes ID cards, $17,000 in cash and several neighbors' keys.
The vacation photos show the couple swimming in the Caribbean, dining at upscale resorts and kissing under the Eiffel Tower. Kirsch is often seen posing in bikinis and slinky outfits.
Anderton, who has returned to his hometown of Everett, Wash., graduated in 2005 from the University of Pennsylvania with an economics degree. Kirsch, the daughter of a North Carolina plastic surgeon, now lives in Novato, Calif.
Police started investigating after a neighbor was told she had a package waiting from a British retailer - an order she had never placed. Suspecting identity theft, she called police, who staked out the UPS store and caught Anderton and Kirsch.
Laptop containing Employee Records Stolen from Agilent Technologies
A laptop containing sensitive information pertaining to over 51,000 current and former employees of Santa Clara, California-based Agilent Technologies was stolen from the car of one of the company’s vendors in March, reports securecomputing.net . Among the sensitive data: employee names, social security numbers, home addresses, and stock option details. Agilent issued a letter to its former employees to inform them of the theft, The letter blames San Jose’s, Stock-Options Solutions, for failing to encrypt the data - a violation of the Agilent’s contract with the vendor.
Spokeswoman Amy Flores says Agilent was “surprised” to find out that the data in the stolen laptop was not protected by encryption. Representatives of Stock-Options Solutions claim that one of their east coast employees had actually brought the laptop to San Francisco, California (where it was stolen) to have the data encrypted. But the device was stolen from the employee’s car before the encryption could take place.
One former Agilent employee, matt O’Brien, expressed disgust over the security breach. In 2006, he says a laptop containing information pertaining to 196,000 current and former Hewlett Packard employees was stolen in a similar incident. Agilent was spun-off from Hewlett Packard in 1999. “(Agilent) should have learned from HP’s mistake,” says O’Brien. “They should have put all of the data into an encrypted format to begin with.”
Agilent hired Stock-Option solutions to ensure that the money management firm Smith Barney had properly transferred employee stock option information to a new management firm, Fidelity Investments. Agilent Technologies manufactures testing and measuring equipment. The company is offering affected employees one year of free credit monitoring through Equifax.
Antioch University Representatives Admit Data Breach
In March, Antioch University belatedly announced that its student records database had been breached on three different occasions in 2007, exposing approximately 70,000 current and former students to potential identity theft, reports electronirecyclers.com. Although Antioch University officials admit an unauthorized intruder breach their system twice late June and once last October, they claim there is no conclusive evidence that any personal information was stolen. The database in question contained the social security numbers, academic records, and payroll documents for thousands of students, dating back to 1996.
University officials say they were aware of each of the intrusions shortly after they occurred, and in each case the server was taken offline and shit down to thwart the intruders. Antioch’s Chief Information Officer, Bill Marshall says “No conclusive evidence has been found that the intruder actually misappropriated and personal information. However, authorities are continuing to analyze all available evidence to determine the extent of the intrusion.”
Many current and former students, however, are not reassured by Marshall’s explanation and have expressed anger that the University took almost five months to notify the student body of the breach. It was not until April that the University began notifying those whose information may have been compromised by sending letters through the mail. Antioch University’s flagship campus Yellow Springs, Ohio plans to temporarily close in June due to declining enrollment. Officials hope to reopen it in 20212. The University also has campuses in Keene, New Hampshire; Los Angeles; Santa Barbara, California; and Seattle.
NY Mayor Bloomberg OK’s e-Waste Collection and Disposal Legislation
April 1, Mayor Michael Bloomberg signed legislation to establish an e-waste collection and disposal program that will require City manufacturers to bear the financial burden of managing discarded electronics within the City’s commercial and residential waste stream has increased considerably in the last several years. Bloomberg says the new program will take the burden of e-waste management off of local government and consumers, and improve NYC’s overall well-being.
Under the new law, manufacturers of computers, monitors, and televisions are required to collect their products offered for return by any person in the city, and to ensure that it is properly disposed of in accordance with EPA guidelines. Manufacturers are also required to submit an e-waste management plan to the city’s Department of Sanitation. The bill will make disposal of e-waste in the city’s solid waste stream unlawful.<
Twelve states have passed similar e-waste laws, but New York City is the first US municipality to do so. Bloomberg says the new law will “protect the health, safety, and welfare of the citizens of New York City...and improve our environment without placing any unreasonable or arbitrary requirements on electronics manufacturers. (Source?)
APWU and NALC File Suit against USPS and Inspector General Over Medical Records Privacy
In late January, the American Postal Workers Union (APWU) and the National Association of Letter Carriers (NALC) filed a suit against the United States Postal Service (USPS) and the office of the Inspector General (OIG) for alleged widespread intrusion into postal employees’ private medical records. The suit, filed in New York’s southern District court, claims that the USPS and OIG sought and obtained employee records directly from hospitals and doctors, beginning in 2006, as part of, as the OIG claims, “oversight and investigatory” activities. It also claims that the OIG instructed medical records providers not to notify affected employees of its records requests.
APWU and NALC union representatives say that this practice constitutes an invasion of workers’ rights to privacy and oversteps the OIG’s authority. Union reps cite the Health Insurance Portability and Accountability Act in support of their suit. APWU President Bill Burrus says, “I am outraged that OIG would use the tactics of police state to investigate workers compensation or sick-leave cases. The OIg has no n=business investigating routine personal matters. The use of these methods demands the strongest possible response.
Top Ten Reasons for Good Records Management Policies
Paperwork constitutes the largest overhead expense in an organization
Large organizations lose a document every 12 seconds
Office staff can waste up to 2 hours a day looking for misplaced documents
Active Files increase at a rate of 25% a year
90% of documents, once created, are never used again
95% of document accesses are to records less than 3 years old
Between 2%-7% of documents are misfiled
Employees spend 7.5% of their time on the computer looking for lost files
The average cost to recreate a lost one page document is $180
66% of the records in an organization without a Recrds Management system could be either destroyed or sent to low cost offsite archival storage