1. MSIA711.041 E- enterprise Liability Liability Requirements (how to incur liability): –By law –By contract Promise of a duty to perform Implied promise of a duty to perform –By Tort intentional (libel and slander) negligent (lack of reasonable care in handling information) strict liability (limited to statutory acts, such as blasting) – By Relationship Husband-to-wife, parents-to-children, guardians-to-children Business relationship: master/servant, principal/agent

2. MSIA711.042 E- enterprise Liability Duties of Internet Services Providers: –Protect Lawful Copyright Holders Against infringement by subscribers who post material to ISP site. Millennium Act: holds ISPs liable for copyright infringement jointly with subscriber if: –ISP is informed by the copyright holder of the infringement, and (1) does not inform the subscriber of the complaint, or (2) does not remove the infringing material from the web within a reasonable time. –ISP not liable if the subscriber refutes the copyright holder’s claim, and the copyright holder does not sue subscriber.

3. MSIA711.043 E- enterprise Liability –Protect the Public at Large Against libel: libel is a method of defamation expressed by print, writing, pictures or signs. Defamation is an intentional false communication, either published or publicly spoken, that injures another’s reputation or good name. Against slander:the speaking of base and defamatory words tending to prejudice another in his reputation, community standing, office, trade, business, or means of livelihood. If an ISP allows a subscriber to defame someone using the ISP’s bulletin board: –Is it libel or slander? –Is the ISP liable, jointly with the subscriber?

4. MSIA711.044 E- enterprise Liability Duties of Internet Services Providers (continued): –Protect the privacy of subscribers: Against discovery? Against spam? Against disclosure of subscriber account information? – Protect the information of subscribers: Against uses not authorized by subscribers, by employees Against uses not authorized by subscribers, by hackers

5. MSIA711.045 E- enterprise Liability Duties of Internet Services Providers (continued) –Publisher (Prodigy model) Prodigy opted to establish and enforce rules regarding what content may be posted by subscribers, to its bulletin boards. A subscriber posted libelous information, and Prodigy was held liable jointly with the subscriber, for failing to exercise a reasonable duty to enforce its own content policy. –Distributor (Compuserve model) Compuserve opted to establish and enforce no rules regarding what content may be posted by subscribers to its bulletin boards. A subscriber posted libelous information, and Compuserve was not held liable jointly with the subscriber, because the court found that Compuserve had no duty to police its bulletin board.

6. MSIA711.046 E- enterprise Liability Customer Information Protection Duties of Website and Portal Providers –Gramm-Leach-Bliley Act, 15 USC §§ 6801-6810, Protection of Nonpublic Personal Information Establishes duties for financial institutions to “respect the privacy of its customers and to protect the security and confidentiality of those customers’ nonpublic personal information. Duties include: –to insure the security and confidentiality of customer records and information –to protect against any anticipated threats or hazards to the security or integrity of such records –to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer.

7. MSIA711.047 E- enterprise Liability Customer Information Protection Duties of website and portals providers (continued) –In general, a financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless: such institution clearly and conspicuously discloses to the consumer, in writing or in electronic form or other form permitted by the regulations prescribed under section 6804 of this title, that such information may be disclosed to such third party; the consumer is given the opportunity, before the time that such information is initially disclosed, to direct that such information not be disclosed to such third party; and the consumer is given an explanation of how the consumer can exercise that nondisclosure option. – For the consumer, then: If the consumer arranges in advance for no disclosure, can a website disclose even if it follows the above notice requirements? What if the consumer arranges nothing in advance, and does not respond?

8. MSIA711.048 E- enterprise Liability Customer Information Protection Duties of websites and portal sites, continued: – Five FTC Enforcement Actions since the Act’s effective date in 1998: FTC v. GeoCities: settled FTC charges that it misrepresented the purposes for which it was collecting indentifying information from adults and children; Geocities agreed to post on its site in a clear and prominent Privacy Notice, a message to consumers about what information is being collected and for what purpose, to whom it will be disclosed, and how consumers can access and remove the information. To ensure parental control, Geocities would have to obtain parental consent before collecting information from children ages 12 and under.

9. MSIA711.049 E- enterprise Liability Customer Information Protection Duties of web and portal sites, continued: –FTC v. ReverseAuction.com, Inc., settled charges that it violated consumers’ privacy by harvesting consumers’ personal information from a competitor’s site (eBay) and then sent deceptive spam to those consumers to solicit their business. Settlement bars defendant from engaging in such unlawful practices in the future. Defendant must delete the personal information of consumers who received spam but declined to register with defendant, and to give those who did register notice of the FTC charges and an opportunity to cancel their registrations and have their personal information deleted from defendant’s database.

10. MSIA711.0410 E- enterprise Liability Customer Information Protection Duties of web and portal sites, continued: –FTC v. Rennert, et al: Operators of a group of online pharmacies that promoted themselves touting medical and pharmaceutical facilities they didn’t actually have and making privacy and confidentiality assurances they didn’t keep, settled with FTC Settlement prohibits the deceptive claims and requires disclosures about medical and pharmaceutical relationships Defendants barred from billing charge cards without proper consumer authorization and prohibited from disclosing information collected from consumers without the consumer’s authorization Defendants required to notify consumers of their practices regarding the collection and use of consumers’ personal identifying information.

11. MSIA711.0411 E- enterprise Liability Customer Information Protection Duties of web and portal sites, continued: –FTC v. Toysmart.com: defendant misrepresented to consumers that personal information would never be shared with third parties, and then as part of a bankruptcy settlement, disclosed, sold, or offered that information for sale in violation of the company’s own privacy statement. –Agreement forbids the sale of this consumer information except under very limited circumstances Defendant only allowed to sell such lists as a package which includes the entire web site, and only to a qualified buyer, or one that is in a related market and that expressly agrees to be defendant’s “successor in interest” as to the customer information.

12. MSIA711.0412 Enforcing the Law and Regulations in the Conduct of E-Business: Who is Responsible? Respondeat Superior and Negligence Doctrine, and the “law of the deep pocket” –“Let the Master Answer” –The employer should have known... –Sue the one who has money Can an employer be held liable for fraud perpetrated by an employee, when the employee uses the employer’s e-mail? –The agency concept –The “scope of employment” concept

13. MSIA711.0413 Enforcing the Law and Regulations in the Conduct of E-Business: Who is Responsible? Agency Law Conduct of a servant is within the scope of employment if, but only if: –it is of the kind he is employed to perform –it occurs substantially within the authorized time and space limits –it is actuated, at least in part, by a purpose to serve the master, and –if force is intentionally used by the servant against another, the use of force is not expectable by the master. Conduct of a servant is not within the scope of employment if: –it is different in kind from that authorized, far beyond the authorized time of space limits, or too little actuated by a purpose to serve the master.

14. MSIA711.0414 Enforcing the Law and Regulations in the Conduct of E-Business: Who is Responsible? Employee misconduct on the Internet in Agency Law: –Extensive case law confirms that courts traditionally do not use respondeat superior as a basis for expanding an employer’s liability when the employee commits wrongful acts so attenuated or outrageous that they fall outside the scope of employment. Employee misconduct on the Internet in Negligence Law: –Negligent retention or supervision: the employer allowed the wrong to occur because the employer failed to take reasonable care in supervising or retaining the employee-perpetrator. –Notice of an employee who is a bad actor, actual or implied: obligation to use “proper diligence” to discover bad behavior by employees, and proactively investigate workplace incidents.

15. MSIA711.0415 Enforcing the Law and Regulations in the Conduct of E-Business: Who is Responsible? Foreseeability of Perpetrator-Employee conduct: –The employer’s liability will depend upon the scope of the original foreseeable risk tht the employee created through his acts. –If the intervening cause is one which in ordinary human experience is reasonably to be anticipated, or one which the defendant employer has reason to anticipate under the particular circumstances, the defendant employer may be negligent, among other reasons, for failing to guard against it. –Issue for the court: “how was employer put on notice about employee’s misconduct?

16. MSIA711.0416 Enforcing the Law and Regulations in the Conduct of E-Business: Who is Responsible? The Duty to Spot Criminal Conduct by Employees in the Online Worklplace –Is there a duty? –E-mail notwithstanding, are companies held liable routinely for criminal use of their telephone and FAX systems by employee- perpetrators? Will a Company policy proscribing illegal uses of its E- business systems shield it from liability? –Well-drafted policy can show that the employer is not negligent –Published policy should also deter abuse of employer e-business systems.

17. MSIA711.0417 Spies and Saboteurs Trade Theft in Cyberspace: Economic Espionage Act of 1996 (EEA): –The following is a summary of the Act’s criminal provisions: Imposes up to a $500,000 fine and a 15-year prison sentence on any person that steals or misappropriates a trade secret in order to advantage a foreign government, instrumentality, or agent. Imposes up to a $10 million fine on any organization that commits an offense described in the previous provision. Imposes a fine and up to a 10-year prison sentence on any person who steals a trade secret in order to benefit any party, including a foreign corporation, other than the owner. Imposes up to a $5 million fine on any organization that commits an offense described in the previous provision.

18. MSIA711.0418 Spies and Saboteurs Trade Theft in Cyberspace: Economic Espionage Act of 1996 (EEA) - in practice: –Labwerks (1998) A state court judge ordered Sladecutter, Inc., a web design firm, to stop hacking into the computer systems of Labwerks. Court order was the result of a legal wiretap against Sladecutter. –Peoplesoft v. Harris Group (civil case - 1998) Harris sued for hacking into Peoplesoft’s database and obtaining secrets about job seeking client’s salaries and employers. Settled.

19. MSIA711.0419 Spies and Saboteurs Trade Theft in Cyberspace: Economic Espionage Act of 1996 (EEA) in practice (continued): –Cisco theft: May, 2000, David Hawkins was convicted of stealing information about a new CISCO product worth billions, which he used to set up his own company that would manufacture a competing product. Hawkins received a 3-year prison sentence.

20. MSIA711.0420 EEA Compliance Advice Compliance standards and procedures: –The organization must have established compliance standards and procedures to be followed by its employees and other agents that are reasonably capable of reducing the prospect of criminal conduct. Responsibility to oversee compliance: –Specific individuals within high-level personnel of the organization must have been assigned overall responsibility to oversee compliance with such standards and procedures.

21. MSIA711.0421 EEA Compliance Advice Delegation of discretion: –The organization must have used due care not to delegate substantial discretionary authority to individuals whom the organization know or should have known through the exercise of due diligence had a propensity to engage in illegal activities. Communications and training: –The organization must have taken steps to communicate effectively its standards and procedures to all employees and other agents, e.g., by requiring participation in training programs or by disseminating publications that explain in a practical manner what is required.

22. MSIA711.0422 EEA Compliance Advice Monitoring and reporting: –Reasonable steps to achieve compliance with its standards by utilizing, monitoring, and auditing systems designed to detect criminal conduct by its employees and other agents and by having in place and publicizing a reporting system whereby employees and other agents could report criminal conduct by others within the organization without fear. Enforcement and discipline: –Standards must have been consistently enforced, through appropriate disciplinary mechanisms, including, as appropriate, discipline of individuals responsible for the failure to detect an offense.

23. MSIA711.0423 EEA Compliance Advice Enforcement and discipline (continued): –Adequate discipline of individuals responsible for an offense is a necessary component of enforcement; however, the form of discipline that will be appropriate will be case-specific. Continuous improvement: –After an offense has been detected, the organization must have taken all reasonable steps to respond appropriately to the offense and to prevent further similar offenses including any necessary modification to its program to prevent and detect violations of the law.

24. MSIA711.0424 Information Warfare (IW) “Moonlight Maze” and “Electronic Pearl Harbor” What is it? –“Coming to grips with information warfare is like the effort of the blind men to discover the nature of the elephant: the one who touched its leg called it a tree, another who touched its tail called it a rope, and so on. Is a good definition possible? Does having one matter? Perhaps there is no elephant: only trees and ropes that aspire to become one. One aspect of information warfare, perhaps, championed by a single constituency, assumes the role of the entire concept, thus becoming grossly inflated in importance.” Martin Libicki of the National Defense University. “National Security” and “Bogeyman” varieties of IW

25. MSIA711.0425 Information Warfare (IW) IW Forms: –C2W: command and control systems warfare –IBW: Intercontinental Ballistic Warfare –EW: Electronic Warfare (antiradar, anticomms, cryptography) –PSYOPS: Psychological warfare (propaganda, deception) –Hacker Warfare –Economic information warfare (“economic blockade”). –Cyberwarfare: techno imperialism  simula-warfare Info terrorism  Gibson warfare (scifi) Semantic

26. MSIA711.0426 Information Warfare (IW) Chinaspam –Red China’s embassy in Belgrade was bombed by NATO warplanes during May, 1999. –Although an accident, Red China began an IW blitz against U.S. targets world wide. 72,000 attacks in August, 1999. –Similar attacks commenced after the U.S. P2 was downed after a mid-air collision with a Red Chinese Mig. Yugospam –Yugoslavia attempted to blitz NATO with IW. Code war v. Cold war: –Tamil “internet black tigers”; Aum Shinri Kyo cult.

27. MSIA711.0427 Information Warfare (IW) Digital Dirty Tricks and Cyber Plumbers –“Australian Underground”- “we have declared infowar on you” Within 20 minutes, the rival political group’s office had its call center disabled, e-mail jammed, and computer system shut down. –hillaryno.com: diverted internet traffic to the other side. –gwbush.com: cybersquatter that satirized a Presidential candidate. –“blackfax:” A tactic in which the sender repeatedly faxes an all-black piece of paper in a deliberate attempt to break the recipient’s machine. Backlash from the Rep. Hyde scandal.

28. MSIA711.0428 Information Warfare (IW) Defensive Information Warfare - Recommendations –Contact law enforcement when attacks are detected. –Turn on audit trails and logs. –Use keystroke monitoring. –Designate an incident management team. –Designate evidence custodian. –Record dollar losses associated with the incident. –Make back-ups, print out logs. –Document activity –“Theorize” - law enforcement will need to know where to start, they will ask how the hacker got in, etc.

29. MSIA711.0429 The First Amendment and the Internet The Communications Decency Act of 1996 –Part of the Telecommunications Act of 1996 –Struck Down by the Federal Court Judicial Review of 1st Amendment Restrictions Imposed by the Communications Decency Act –Strict Scrutiny: Court found that the CDA’s premises were not proven. –Were the statutory requirements the least intrusive? Technical means to achieve the CDA’s objectives Parental Controls such as the V-chip Industry-standard ratings for violence, sex, foul language, etc.

30. MSIA711.0430 After CDA: The Children’s Online Protection Act (COPA) Addresses the two CDA provisions that were found to be unconstitutional: –Cannot transmit any “communications which is obscene or indecent, knowing that the recipient of the communication is under 18 years of age.” –No transmission to someone under 18 “communication that, in the context, depicts or describes, in terms patently offensive as measured by contemporary community standards, sexual or excretory activities or organs.” Supreme Court holding in CDA case: –Compelling state interest, but... –No reason for unnecessarily broad suppression of speech to adults

31. MSIA711.0431 After CDA: The Children’s Online Protection Act (COPA) COPA –Prohibits “knowingly and with knowledge of the character of the material...by means of the world wide web, making or communication for commercial purposes...available to any minor...that includes any material that is harmful to minors.” Only applies to web communications Only commercial communications are affected Only applies to communication that is harmful to minors –Non-compliance with the COPA results in criminal and civil penalties, including fines and imprisonment. –Allows for good faith defenses, including credit/debit cards, adult access code, or adult PIN, digital certificate that verifies age, etc.

32. MSIA711.0432 After CDA: The Children’s Online Protection Act (COPA) COPA Challenged: –Did not fix the CDA problems –Congress attempted to use internet technology to verify age and distinguish minors from adults, as an attempt to fix the CDA problems of “too burdensome.” –District Court stayed COPA, after finding that the Constitutional issues raised by plaintiffs (ACLU and others) have a good chance at succeeding when the case makes it to the Supreme Court. –Is it possible to craft a statute that protects children online from indecent communication?

33. MSIA711.0433 FIRST AMENDMENT RIGHTS V. THE NEED TO PROTECT CHILDREN Methods used by websites to obtain info from kids: –Info needed to chat with fictitious cartoon characters –Info needed to play games, enter contests and enter chat rooms 1996 FTC Workshop Conclusions: –Children are a special online audience –Information collection from children raises special concerns –A need to notify parents of web site information practices –A need to provide parental control over info collected from kids

34. MSIA711.0434 FIRST AMENDMENT RIGHTS V. THE NEED TO PROTECT CHILDREN DOJ/FBI Staff Report: –Child chat rooms are used by adult predators of children –A reporter, posing as a known child murderer, obtained a list of 5,000 children living in various neighborhoods

35. MSIA711.0435 The FTC’s “Son of COPA” The FTC’s Child Online Privacy Protection Rule (4/2000) –Supplements COPA Definitions follow COPA, but account for developing technology Notice is further required at each site, and specified Operator prohibited from conditioning child participation on personal information disclosure –Added procedural sense to COPA Operators must make a good faith effort to obtain “verifiable parental consent” before information can be taken and stored from children Reasonable exceptions, triggered by good faith efforts on the part of operators, remove the objectionable aspects of COPA FTC rules received positive acclaim from the privacy lobby as a reasonable compromise to COPA’s draconian measures.

36. MSIA711.0436 FBI Crackdown on Predators of Children, and Child Pornography FBI “Innocent Images” Program –Launched in 1994, the FBI discovered that pedophiles frequently share child pornographic materials through elaborate encryption schemes. Also, packs of predators would hunt children online. –FBI agents, posing as children, conducted online sting operations Results (1997 numbers): –200 search warrants –40 consensual searches –91 arrests –83 felony convictions –By 1999, 1,497 cases were opened, yielding 532 arrests.

37. MSIA711.0437 The Effectiveness of Protecting Our Children’s Privacy Online CDA, COPA: Wrapped up in Court Challenges FTC’s Rules: –Violators don’t take rules seriously: estimated 88% of the most popular children’s sites still collect personal information from children without parental consent. –Systematic detection is not technically feasible right now. Self-regulation? –TrustE and BBB guidelines work well, but parents and children must be diligent to allow kids to use websites that contain those service marks, exclusively. –If parents were diligent in the first place, would COPA and the FTC regulations be necessary?

38. MSIA711.0438 GOVERNMENT ENFORCEMENT Federal –FTC, FCC, DOJ, BATF, Dept. of Commerce State: –Consumer protection laws, tax laws Local –Courts (enforce contracts0 International: –Treaties (e.g., WTO/World Court)

39. MSIA711.0439 Criminal Liability Laws to Combat Internet Crimes: Hacking Cracking: –Counterfeit Access Device and Computer Fraud and Abuse Law fo 1984; Computer Fraud and Abuse Act of 1986 –National Information Infrastructure Protection Act of 1996: Applies to computers and computers attached to the internet in one or multiple states. Codified at 18 USC §1030 et seq. Prohibits computer espionage and theft of financial information. Prohibits theft of U.S. government information and information from protected computers and hacking. Makes computer fraud and trespass illegal. Outlaws password trafficking and computer extortion.

40. MSIA711.0440 Criminal Liability National Stolen Property Act –Covers illegal fund transfers and software transmission. Electronic Communications Privacy Act of 1986 (ECPA) –Bars illegal surveillance and unauthorized access to data. Fraud (statutes): –Federal Trade Commission Act –Clayton Act –Truth in Lending Act –Fair Credit Billing Act –Fair Credit Reporting Act –Telephone Disclosure and Dispute Resolutions Act

41. MSIA711.0441 Criminal Liability Fraud (400 FTC regulations covering specific transactions) for example: –Used car rule –Franchise rule –Telemarketing sales rule –The “Ten dot.cons” Cyberstalking: –Executive Order 13133, Unlawful Conduct Using the Internet Theft of Intellectual Property –No Electronic Theft Act –Economic Espionage Act –Copyright Felony Act

42. MSIA711.0442 INTERNET FRAUD FTC’s Dot.com Disclosures: Information about Online Advertising The same consumer protection laws that apply to commercial activities in other media apply online –No “unfair or deceptive acts or practices” –FTC issues rules and guides for specific industries and subject areas, e.g., telemarketing, vitamin supplements and travel agencies. –The “Plain Language” rule –“Clear and conspicuous disclosure” rule –Duty to communicate with customers can be satisfied online: ship goods when promised or otherwise within 30 days, negative option communications, written warranty obligations

43. MSIA711.0443 INTERNET FRAUD FTC’s Dot.com Disclosures: Information about Online Advertising To Guaranty that disclosures are not misleading, advertisers should consider: – The Placement of the disclosure in an ad and its proximity to the relevant claim. –The Prominence of the disclosure –Whether items in other parts of the ad distract attention from the disclosure –Whether the ad is so lengthy that the disclosure needs to be repeated –Audio disclosures are in appropriate volume and cadence –Visual disclosures are of sufficient duration

44. MSIA711.0444 INTERNET FRAUD FTC’s Dot.com Disclosures: Information about Online Advertising To make a disclosure clear and conspicuous, advertisers should: –Place disclosures near, and when possible, on the same screen as the triggering claim –Use text or visual cues to encourage consumers to scroll down a Web page when it is necessary to view a disclosure –When using hyperlinks to view a disclosure: Make the link obvious * Label the hyperlink appropriately Use consistent styles so the customer knows they are there Place the hyperlink near relevant info * Make it noticeable Take consumers directly to the disclosure on the click-thru page Assess effectiveness - monitor click-thru rates and change if needed

45. MSIA711.0445 INTERNET FRAUD FTC’s Dot.com Disclosures: Information about Online Advertising To make a disclosure is clear and conspicuous, advertisers should (continued): –Recognize and respond to any technological limitation or unique disclosure techniques, such as frames or pop-ups –Display disclosures prior to purchase, and don’t necessarily restrict them to the order page –Creatively incorporate disclosures in banner ads or disclose them clearly and conspicuously on the page the banner ad links to. –Prominently display disclosures so they are noticeable by consumers, and evaluate their size, color, and graphic treatment –Ensure that the text, graphics, hyperlinks, or sound do not distract consumers’ attention from the disclosure.

46. MSIA711.0446 INTERNET FRAUD FTC’s Dot.com Disclosures: Information about Online Advertising To make sure that disclosures are clear and conspicuous, advertisers should (continued): –Repeat disclosures as needed on lengthy websites and in connection with repeated claims. –Use audio disclosures when making audio claims, and present them in a volume and a cadence so that consumers can hear and understand them –Display visual disclosures long enough for consumers to notice, read, and understand them. –Use clear language and syntax so that consumers understand the disclosures.

47. MSIA711.0447 INTERNET FRAUD FTC’s Dot.com Disclosures: Information about Online Advertising FTC rules and guides that use specific terms: “written,” “writing,” “printed” or “direct mail” are adaptable to the internet –Rules and guides that apply to written ads or printed materials also apply to visual text displayed on the Internet. –If a seller uses email to comply with Commission rule or guide notice requirements, the seller should ensure that consumers understand that they will receive such information by email and provide it in a form that consumers can retain. –“Direct Mail” solicitations include e-mail. If an email invites consumers to call the sender to purchase goods or services, that telephone call and subsequent sale must comply with the Telemarketing Sales rule requirement.

48. MSIA711.0448 Spies and Saboteurs Insiders - the Disgruntled Employee –“Adelyn loves Larry,” so Larry fires Adelyn Larry Ellison, Oracle’s CEO had an alleged affair with an employee, Adelyn Lee. After an unsuccessful date, Larry has Adelyn fired. Adelyn sues Oracle for wrongful dismissal, after producing numerous e-mail messages between them and between Larry and the guy he ordered to fire Adelyn. She wins $100k. County prosecutors found evidence, however, that Adelyn herself created those incriminating e-mails. She was found guilty of felony perjury, had to give the $100K back, and spent a few months in jail.

49. MSIA711.0449 Spies and Saboteurs The Disgruntled Employee –“Omega Man,” Tim Allen Lloyd Omega Engineering Corp. serves NASA and the USN; lost $10 million due to Lloyd’s software “time bomb” that “exploded” two weeks after Lloyd was terminated by Omega. Lloyd went from “hero to zero,” lashing out at his colleagues both physically and verbally; bottlenecked projects that he wasn’t placed in charge of, and even knowingly loaded faulty programs to make co- workers look bad. He was written up twice, demoted, and terminated. Lloyd was convicted and sent to jail.

50. MSIA711.0450 Cyber Muggers and Molesters Identity Theft –Adelaide Andrews Investment researcher began receiving disturbing phone calls from money lenders and collection agencies looking for payments she had no idea that she owed. Situation grew worse: her application for refinancing her home mortgage was rejected, because the bank said she was a bad credit risk. IRS informed her she owed taxes on income she never earned. There was even a Nevada arrest warrant for domestic battery issued against her. Someone used her identity to establish credit lines of up to $100k, rented apartments, set up utilities, and took in income. Adelaide hired a PI to track down the identity thief, whom she suspected.

51. MSIA711.0451 Criminal Liability The Identity Theft Epidemic –Trans Union consumer complaints rose from 35,236 in 1992 to 522,922 in 1997. –Techniques: Chinese method: hack into databases to compromise credit cards and identity details (Social Security Numbers are biggest prize). Nigerian method: bribe bank officials to obtain customer information. How to Prevent Identity Theft: –Call 888.567.8688 and request that your name be removed from marketing lists to reduce the number of pre-approved credit card applications that you receive via snail mail. –Protect your SSN and check your credit reports annually.

52. MSIA711.0452 Criminal Liability How to Prevent Identity Theft (continued): –Credit reporters that need to be checked annually: Equifax, fraud line 800.997.2493 Experian, 888.397.3742 Trans Union:, fraud line 800.680.7289 What to do if you become a victim: –Secret Service’s tips ( ): Report the crime to your local police immediately, and obtain a case number that banks and financial outfits will ask for, later. Contact immediately your credit card issuers, and get replacement cards with new account numbers; close out existing accounts “by customer request. Follow up these requests in writing. Report theft to the credit reporters above, and have accounts flagged.

53. MSIA711.0453 Criminal Liability What to do if you become an Identity Fraud Victim(cont’d) –File a complaint with the FTC: The FTC has no statutory authority to bring a criminal case against an identity thief, but it has vast resources to investigate theft and gather evidence against identity thieves. It can also refer your complaint and the evidence to the FBI, Secret Service, and others. Consumer Response Center, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. 877.382.4357