Investigative & Security Professionals for Legislative Action

FTC Uncovers Data Widespread Data Breaches

24 Feb 2010 2:09 PM | Anonymous member (Administrator)

Widespread Data Breaches Uncovered by FTC Probe

FTC Warns of Improper Release of Sensitive Consumer Data on P2P File-Sharing Networks

Feb. 23, 2010 – The Washington Post reports security experts say the Federal Trade Commission’s investigation is the broadest of its kind by the agency and comes amid recent outrage over missteps by Google on how it handled users' data in its recent launch of a new social-networking application, Buzz. Facebook faced similar criticism in December when changes to its privacy policy caused confusion among users and left some of their information more widely available to the public.

Concerns about Internet privacy also have intensified as broadband and other technologies become more widespread. Consumer advocates, for example, are leery of advertisers using global-positioning satellite technology to track cell phone users. Law enforcement officials routinely ask companies with cloud computing applications, such as Microsoft and Yahoo, for information about users, yet there are no clear rules dictating how federal regulators should address those and other issues.

"Everything is coming to a head here and the FTC is acting effectively and prudently in trying to grapple with this very fast moving marketplace," said Jeffrey Chester, executive director of the Center for Digital Democracy.

The FTC has notified almost 100 organizations (some with only 8 employees) that personal information, including sensitive data about customers and/or employees, has been shared from the organizations’ computer networks and is available on peer-to-peer (P2P) file-sharing networks to any users of those networks, who could use it to commit identity theft or fraud. The agency also has opened non-public investigations of other companies whose customer or employee information has been exposed on P2P networks. To help businesses manage the security risks presented by file-sharing software, the FTC is releasing new education materials that present the risks and recommend ways to manage them.

Peer-to-peer technology can be used in many ways, such as to play games, make online telephone calls, and, through P2P file-sharing software, share music, video, and documents. But when P2P file-sharing software is not configured properly, files not intended for sharing may be accessible to anyone on the P2P network.

“Unfortunately, companies and institutions of all sizes are vulnerable to serious P2P-related breaches, placing consumers’ sensitive information at risk. For example, we found health-related information, financial records, and drivers’ license and social security numbers--the kind of information that could lead to identity theft,” said FTC Chairman Jon Leibowitz. “Companies should take a hard look at their systems to ensure that there are no unauthorized P2P file-sharing programs and that authorized programs are properly configured and secure. Just as important, companies that distribute P2P programs, for their part, should ensure that their software design does not contribute to inadvertent file sharing.”

As the nation’s consumer protection agency, the FTC enforces laws that require companies in various industries to take reasonable and appropriate security measures to protect sensitive personal information, including the Gramm-Leach-Bliley Act and Section 5 of the FTC Act. Failure to prevent such information from being shared to a P2P network may violate such laws. Information about the FTC’s privacy and data security enforcement actions can be found at www.ftc.gov/privacy/privacyinitiatives/ promises_enf.html.

The notices went to both private and public entities, including schools and local governments, and the entities contacted ranged in size from businesses with as few as eight employees to publicly held corporations employing tens of thousands. In the notification letters, the FTC urged the entities to review their security practices and, if appropriate, the practices of contractors and vendors, to ensure that they are reasonable, appropriate, and in compliance with the law. The letters state, “It is your responsibility to protect such information from unauthorized access, including taking steps to control the use of P2P software on your own networks and those of your service providers.”

The FTC also recommended that the entities identify affected customers and employees and consider whether to notify them that their information is available on P2P networks. Many states and federal regulatory agencies have laws or guidelines about businesses’ notification responsibilities in these circumstances.

Samples of the notification letters can be found at: http://www.ftc.gov/os/2010/02/100222sampleletter-a.pdf, http://www.ftc.gov/os/2010/02/100222sampleletter-b.pdf, http://www.ftc.gov/os/2010/02/100222sampleletter-c.pdf.

The fact that a company received a letter does not mean that the company necessarily violated any law enforced by the Commission. Letters went to companies under FTC jurisdiction, as well as entities such as banks and public agencies over which the agency does not have jurisdiction.

Assisting the FTC were the Department of Health and Human Services, the Securities and Exchange Commission, the Federal Reserve Board, the Federal Deposit Insurance Corporation, the Office of Thrift Supervision, and the Office of Comptroller of the Currency.

The new business education brochure – titled Peer-to-Peer File Sharing: A Guide for Business – is designed to assist businesses and others as they consider whether to allow file-sharing technologies on their networks, and explain how to safeguard sensitive information on their systems, and other security recommendations. This information is available at www.ftc.gov/bcp/edu/pubs/business/idtheft/bus46.shtm. Tips for consumers about computer security and P2P can be found at www.onguardonline.gov/topics/p2p-security.aspx.

ISPLA has been closely following a number of security breach bills in the House and Senate, along with monitoring the activities of the FTC.

                                                         ISPLA

Powered by Wild Apricot. Try our all-in-one platform for easy membership management