TSA’s Muddy Response to the Clear Shutdown

Earlier today,a friend of mine sent out a Twitter post indicating that Verified Identity Pass, the operator of the soon-to-be defunct Clear “Registered Traveler” program, might be interested in selling the data it possesses about its customers. For those of you unfamiliar with the DHS-sponsored Registered Traveler program, the idea is that in exchange for being fairly seriously vetted, you can speed through the security lines at airports. In this case “serious vetting” doesn’t mean a Scientology-style videotape confession or forfeiting your firstborn child, but it does involve being checked on terror watch lists and sharing a lot of personally identifying information.

The concern that the original story posted on Wired raised, was whether this failed business might seek to profit by selling personal data. Here’s what I know:

1. Clear collects enough personal information to make it a gold mine for identity thieves. Verified Identity Pass collects immense amounts of personally identifiable information so that it can determine applicant eligibility, as required by the TSA. The data collected includes scans of the applicant’s irises and fingerprints. Clear also collects the applicant’s social security number and credit card number, which is used for payment, and biographic information for vetting. It makes digital copies of identifying documents like passports or driver licenses. It is allowed by the TSA to retain all of these things in its data centers.
2. Verified Identity Pass could sell its customer information to another Registered Travel operator. Verified Identity Pass states, in a letter to customers, that the personal information it has collected could potentially be sold to third-parties. In answer to the question, “will personally identifiable information be sold?” VIP answers, “The personally identifiable information that customers provided to Clear may not be used for any purpose other than a Registered Traveler program operated by a Transportation Security Administration authorized service provider. Any new service provider would need to maintain personally identifiable information in accordance with the Transportation Security Administration’s privacy and security requirements for Registered Traveler programs. If the information is not used for a Registered Traveler program, it will be deleted.”
3. TSA deflected concerns about what might happen to Clear's customer information. In its own statement about Clear, TSA answers concerns about disposition of personal information this way: “Questions about how the data is managed should be directed to the vendor. Clear has assured TSA that it is appropriately safeguarding the data. RT service providers were required to use customer data for purposes of the RT program unless customers expressly opted-in to other uses.”

Based on the facts, I’ve concluded that:

• When faced with a cash crunch, companies toss privacy policies aside. No matter how ironclad the seeming promises of privacy, now that it’s in financial trouble Verified Identity Pass thinks it can make a buck on its customers’ personal information. It seems to be treating the highly sensitive information its customers have provided to them as assets to be bought and sold, not as other peoples’ secrets that they are obligated to protect. Clear’s written privacy policy is a model of clarity and economy. It is a shame their customer letter, written under pressure in the rush to shut down, cannot give a simple “yes” or “no” answer about whether they will actually try to sell the stuff. Their evasiveness is shameful.
• The Bush administration’s disregard for citizen privacy will take years to undo. The TSA’s feeble response to the issue of Clear’s customer data laughable. How can the TSA simply “direct questions to the vendor?” The TSA Undersecretary must be high — and not 35,000 feet high, either. Despite all of the fine words in the recent cybersecurity plan (which I blogged about recently) noting the importance of citizen privacy, these are not a substitute for action. Inaction, in this case, speaks louder than words.
• Some things shouldn’t be left to the private sector. When the Aviation and Transportation Security Act was passed, it established the TSA’s authority to take over passenger screening operations at airports. Why? Because the private sector was seen as doing a lousy job, and the function was thought to be so vital to the national interest that it should be run by the government. Why should the Registered Traveler program be any different? The Clear program hasn’t exactly kept its nose clean: nearly a year ago, staff lost an unencrypted laptop containing personal information on 33,000 passengers.

Here's what TSA should do: impound Clear’s customer data immediately, using the authority granted it under ATSA §114(f). It should also release a real response to Clear customers that states in clear language exactly how and when traveler personal information collected by Clear will be destroyed. Finally, it should seek funding for a federally-managed Registered Traveler program, rather than punting to the private sector, if such a program is still deemed desirable. If Congress has no appetite for a federally-run Registered Traveler program, it should be shut down completely.

Granted, the regulatory environment is changing. How will this affect us?

We are now approaching the half-way point of 2009, and most of us are still trying to figure out the nature and scope of regulations that will descend in reaction to the massive corporate failures of the last 9 months. Considering the hefty burden brought by Sarbanes-Oxley in reaction to — by comparison — less egregious issues, it’s no wonder risk and compliance professionals are waiting with nervous anticipation.

New legislation continues to pass at a fast clip in the US under the new administration, however we have only seen pieces of what we can expect will be significant changes to the regulatory controls mandated for many aspects of corporate operations.

Some of the most revealing actions taken so far include:

- May 20, 2009 - President Obama signed the Fraud Enforcement and Recovery Act of 2009.  FERA allocates substantial budget (more than $300 million) to the SEC, FBI, Justice Department, and other agencies to investigate “possible criminal, civil, or administrative violations and for criminal, civil, or administrative proceedings involving financial crimes and crimes against Federal assistance programs.” It will also create a commission to explore possible causes of the financial crisis, including regulatory mistakes, fraud, poor compensation practices, and over-reliance on numeric tools such as risk models and credit ratings.

- June 12, 2009 - United States Congressman Gary Peters introduced his Shareholder Empowerment Act to the House. This bill would give shareholders greater voice in votes on executive compensation and board membership as well as more disclosure on specific performance targets and bonuses. Senator Charles Schumer proposed similar legislation on May 19th. The one major addition in Senator Schumer’s Shareholder Bill of Rights Act of 2009 is the requirement that all public companies have an independent board-level risk committee, whose responsibility would be “the establishment and evaluation of the risk management practices of the issuer.”

- June 17, 2009 - President Obama outlined plans for more sweeping reform of financial regulations that would aim to consolidate supervision over all firms that pose a risk to the financial system as a whole.  Specifics are still in the works, but the Treasury Department explained that aspects of this regulation would include the creation of an agency to protect consumers by further regulation of firms that provide credit, savings, payments, or other financial services; further protection of corporate whistleblowers and larger sanctions for regulatory enforcement; review and possible modification of risk management guidance based on Basel II; and increased international cooperation to enforce anti-money laundering and terrorist funding standards.

Themes among these legislative actions include fraud prevention, transparency, shareholder and consumer rights, and stronger risk management oversight. The burden will be placed squarely on risk and compliance professionals and their cohort in the IT department. Even more visibility and control will be required for financial transactions as well as the context (emails, voice mails, related transactions, etc.) in which they took place. Monitoring and reporting more detailed risk information to regulators as well as potentially to a risk committee will also require a level of rigor most companies are not yet set up to tackle.

By now, plans should be in place to start addressing some of these high level concerns.  The exact methods and timelines by which organizations will need to comply with these new regulations are still being worked out, however it’s quite clearly a matter of when, not if they will come. And for those of you not working in financial services, please note that much of the focus has been on public companies as a whole, not just those in the financial sector.

As always, you’re welcome to share your thoughts on how your company is preparing, and whether you expect these new regulations to have more or less of an impact on risk and compliance departments compared to SOX.

Chris McClean
 

No Honor Among Thieves

In the old days criminals like Robin Hood and Don Corleone had scruples. Remember when Don Vito stood up to Virgil "The Turk" Sollozzo and refused to become involved in the heroin trade? The Don stood for honor at the cost of a couple of bullets.

It seems that modern cyber criminals are more like Sollozzo. One disturbing trend seems to be the exploitation of nonprofits to enumerate valid credit card numbers. Recently, some nonprofits have been inundated with bogus, fraudulent donations. Typically the donations are small amounts, although larger donations have been seen. When the nonprofit organization goes to reconcile these transactions, they discover that the account is fraudulent. Unfortunately, these organizations may suffer from chargebacks as well as concurring the enormous effort involved in straightening this stuff out.

It appears that these credit card thieves are using the donation websites to try to determine which cards are valid and therefore, which numbers they can sell to their clients for more nefarious purposes.

If any of you have experienced something similar, we'd love to hear about it. Cyber crime is a fact of life in the Internet age, but targeting nonprofits and charitable organizations is beyond the pale. No one expects thieves to renounce their life of crime, but is just a little bit of honor too much to ask? 

Why Consumers Use Security Freeware

I’ve been doing a lot of research into the consumer security market lately, and with it the rise of consumer security freeware (AVG, etc). One of the interesting findings is that those who use security freeware are not primarily motivated by price. In fact, price is less of an influence on their selection than it is for the consumers who use paid security products.

You all wear IT security hats during the day. But if you’re like me, that hat never gets completely removed when outside of work either: you protect your computers at home, and you also help protect those of your family members, your friends, and the occasional neighbor or two. Indeed, when it comes to computer security, you’re likely a savvy consumer shopper and a strong influencer of other people's purchases. So if you use free consumer security software, considered using, or used it and switched back to pay versions, take a look at my new post on the security freeware trend. I’d love to hear your thoughts on this.