Privacy and Security Bits and Bytes

After a bit of a hiatus, our Friday afternoon feature is back:

• Do you know what your information is worth on the black market? It may just surprise you. Good piece on a new Symantec tool to let you do the calculations. See Information Security Resources - What Are You Worth On The Black Market?
  
• Despite all of the public flurry surrounding security breaches, and customer expectations that the information entrusted to vendors will be secure, a new survey finds that an astounding 71 percent of those companies surveyed said they still weren't making data security a top initiative in their IT budgets, even though 79 percent of them admitted that they had been hit by one or more data breaches since the PCI DSS standard was enacted in 2005. Companies Still Not Securing Customer Data - InternetNews.com.
• Companies around the world are preparing for the swine flu pandemic and putting policies and procedures in place for workers and business continuity. What, if anything, are people doing about the privacy issues that need to be addressed in that planning?
  Good article, with links to resources here - Protecting Your Privacy During a Pandemic
• Remember our blog posts on the demise of the Clear program? Next week, the Committee on Homeland Security is holding a hearing on "The Future of the Registered Traveler Program"
  Wednesday, September 30, 2009 @ 2pm
  311 Cannon House Office Building
  The hearing will evaluate the recent cessation of operations by Registered Traveler (RT) providers, actions undertaken by the Transportation Security Administration (TSA), and the impact on airports. There will be a webcast of this hearing.

Should be fascinating viewing. I wonder if we'll hear anymore about whatever happened to all that data???

Not "Clear" What Happens to Passenger Data.....

Bad news if you were a frequent flyer who ponied up the $199 annual fee to participate in Verified Identity Pass, Inc.'s registered traveler program, branded as "Clear." Last night, the company announced that it was "unable to negotiate an agreement with its senior creditor" and shut down. Membership fees will not be refunded.

The bigger concern is what will happen to the (very) personal information of some 260,000 travelers who had registered and been "cleared." In order to receive a Clear card, you had to provide substantial background information, fingerprints and iris scans. In its announcement, Clear Lanes Are No Longer Available, the website says that the company will take "appropriate steps" to delete its customers' personal data. Given some of the prior history of the company with respect to securing that information, I am not reassured by that statement.

Last year, the company acknowledged temporarily losing an unencrypted laptop at San Francisco International Airport that contained the personal data of approximately 33,000 of its customers. In a press release, the Transportation Security Administration announced at the time that it was temporarily suspending Verified Identity Pass' operations of the Clear program until VIP got its security house in order. The question is: now what? Does a bankruptcy judge decide what happens to the data? Will those whose information is in the database be informed in a manner other than a post on the company website? What methods will this now-defunct company use to "delete" the wealth of personal data it has on 260,000 Americans and how can those people be assured that any such deletion is reliable (I'll be interested in hearing about that...)?

Tip of the iceberg...............



See also: Clear's Privacy Policy