The ChoicePoint Attack – Case Study CHAPTER 12 Lecturer : Dr. Thi Lip Sam FUJIAH KASIM - 803816 RAINI ANNE LAIPAN - 803738

Case Summary ChoicePoint is a Georgia based corporation, involved in the Data Brokerage Industry that store and sells critical personal information, provides risk-management and fraud prevention data or information. In the fall of 2004, ChoicePoint was the victim of a fraudulent spoofing attack in which unauthorized individuals posed as legitimate customers and obtained personal data on more than 145,000 individuals’ details. It was not until November 2004 that ChoicePoint became aware of the problem. They noticed some unusual activities on accounts in Los Angeles, so ChoicePoint notified the LAPD.

Case Summary…Conti The LAPD requested that ChoicePoint not reveal the activity until the department can conduct its investigation. It was not until January that the LAPD allowed ChoicePoint to connect its customers whose data was compromised. The crime is an example of a failure of authentication and not a network break in. The criminals obtained valid business licenses and appeared as a legitimate business.

Case Summary…Conti Since ChoicePoint did the right thing and contacted the police, it exposed itself to considerable expenses, a class-action lawsuit which cost them $75,000 for each of the 145,000 people , a Senate investigation, and 20% decreased in its share price.

Question no 1. ChoicePoint exposed itself to considerable expense, problems and possible loss of brand confidence. What are the ethical issues? What is ChoicePoint’s response? Did ChoicePoint choose wisely?

We think ChoicePoint made a wise decision because its reputation was on the line. If they had covered up the entire incident and were later found out, the company would be blamed of fraud and possibly charge for withholding criminal evidence from the police. Managers and investors could possibly disagree because it hurts the company’s image when public relations nightmares are let out of the bag like that. When stock drops a significant amount, investors will always be the first to complain but upon a second glance, we would hope people would rather invest in an honest company interested in serving its customers to the best of its ability. Customers would obviously be upset over the events but ChoicePoint made every effort to right the situation and make sure their clients were safe and satisfied.

Consider the question from the viewpoint of…. Customer : They had a right to know that their information had been compromised. Law enforcement personnel : They need to know all details so that they could conduct their own investigation and possibly catch the criminals. Investor : The price of their stock would decline when the news would be disclosed, but long term it would help that ChoicePoint did not hide the facts. Management : They must consider the factors and take cost-effective action to reduce probable losses

Question no 2. Given ChoicePoint’s experience, what is the likely action of similar companies whose records are compromised in this way? This crime is an example of a failure of authentication, not a network break in ChoicePoint's firewalls and other safeguards were not harmed.  

The action that should be taken by the similar companies to avoid such problems in the future could be issuing more authentication methods. For instance include an username, password, include some sample questions that the answers will be known only to a given individual. Evaluating the security program of the given company at a given time   Keeping an eye on the activity of the accounts so every abnormality will be quickly spotted.

Given your answer, do you think federal regulations and additional laws are required?  Regarding to the fact that there is an increasing level of identity theft in this country even though companies  are trying to find security solution for that, there is a definite need for issuing tougher laws that will protect people, when the information about them is stolen, or simply somebody is using that information without their consent / permission. Regulations must be clear that identity theft is a serious crime, and there is a punishment for those who do this kind of activity. Current Regulation: Fair Credit Reporting Act (FCRA), Federal Trade Commission (for Data Broearage Firms) and California Disclosure Law, Senate Bill 1386.

What other steps could be taken to ensure that data vendors notify people harmed by data theft? security needs to be applied closely to the information, it is protecting to be effective. make the information less available for "third parties" Google documents. ensuring that protection cannot be arbitrarily removed by end-users or system administrator. controlling access and usage privileges  

Question no 3. Visit --- http://choicepoint.com Summarize the products that ChoicePoint provides. What seems to be the central theme of this business?

Answer question no 3. 1. When it comes to Business & Nonprofit, it delivers comprehensive credentialing, background screening, authentication, direct marketing and public records services to businesses and nonprofit organizations. 2. When it comes to Government, it provides information, analysis and distribution solutions to advance the efforts of law enforcement, public safety, healthcare, child support enforcement, entitlement and other public agencies. 3. When it comes to Reports of one’s self, you can learn how to request the information LexisNexis or ChoicePoint, a LexisNexis company since September 19, 2008, has about you. If an organization has recently ordered reports about you from LexisNexis or ChoicePoint, or if you are just curious, you can obtain copies of those reports at no charge.

Central theme The LexisNexis Risk Solutions delivers actionable intelligence to help clients make critical business decisions with confidence and speed. Their solutions are designed to serve the multi-billion dollar risk information industry, which includes professionals and organizations in areas such as insurance and law enforcement.

Question no 4. Suppose that ChoicePoint decides to establish a formal security policy on the issue of inappropriate release of personal data. summarize the issues that ChoicePoint should address.

Anwer Question 4 Developing a Security Policy. Security Principles. Security Policy Fundamentals To make a long story short... a security policy establishes the expectations of the customer or user, including what their requirements are for confidentiality, integrity, and appropriate management of their data, and the conditions under which they can trust that their expectations are met.

Case Solved? On October 26, 2004, one of the thieves -- Olutunji Oluwatosin was arrested after receiving a fax from ChoicePoint requesting an additional signature for one of the illegitimate companies the thieves has previously set up.